Description

Detects when Android applications implement unsafe SSL/TLS certificate validation by shipping no network security configuration, since for API levels lower than 24 the default behavior is to trust user-supplied CAs. This creates a significant security risk as it could allow man-in-the-middle attacks by accepting invalid or malicious certificates without proper verification.

Detection Strategy

• Checks if the APK has no res/xml/network_security_config.xml file

• Checks if targetSdkVersion is lower than 24, or is not declared

• Reports a vulnerability when both are true