285 – Insecure service configuration - App Transport Security
Description
The NSAppTransportSecurity function has the NSAllowsArbitraryLoads option enabled which allows insecure (HTTP) connections to the application. Good security practices state that insecure connections from the app to external servers should not be allowed.
Impact
Conduct MitM attacks over insecure channels to obtain sensitive user information.
Recommendation
Configure in the applications info.plist following good security practices.
Threat
Internal attacker on the same network segment.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: A
- Attack complexity: H
- Attack Requirements: N
- Privileges required: N
- User interaction: P
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: X