Notification Spoofing

Notification Spoofing

Risk: high

Description

The application exposes an input to receive unauthorized notifications, exposing the users to phishing, unauthorized access or even remote code execution.

Notification attacks have leveraged in the by malicious applications like WolfRAT and Mandrake.

A common cause of unauthorized notifications' exposure is insecure or missing permissions on Firebase services or 3rd party push notification like Cordova PushHandlerActivity.

Recommendation

To prevent unauthorized notifications, ensure the following protections are implemented:

• Services and activities receiving notifications should be restricted with proper permissions
• Ensure the permissions are set with secure protection levels appropriate to the application context

Links

• Cordova Push Plugin Security Issue

Standards

• OWASP_MASVS_L1:
  • MSTG_AUTH_12
• OWASP_MASVS_L2:
  • MSTG_AUTH_12