Overview

iOS apps can reconstruct objects from serialized data received through files, IPC payloads, network responses, pasteboard data, app extensions, or archived data stored locally. If an attacker can influence this data and the app decodes it without restricting the expected classes, the app may accept unexpected object types. This can lead to object substitution, unintended application behavior, or unsafe state changes.

Developers can introduce this risk when they deserialize potentially untrusted data without enforcing secure coding or class restrictions. Common cases include:

This test checks whether the app deserializes potentially untrusted data without enforcing secure coding, class restrictions, or equivalent validation. For background on iOS serialization mechanisms, see MASTG-KNOW-0075.

Steps

  1. Use MASTG-TECH-0058 to extract the relevant binaries from the app package.
  2. Use MASTG-TECH-0066 to look for the relevant APIs in the app binaries.

Observation

The output should contain a list of locations where object deserialization APIs are used, indicating whether each location enforces secure coding and restricts the decoded classes.

Evaluation

The test case fails if the app deserializes data from a potentially untrusted or attacker-influenced source using APIs that don't enforce secure coding, class restrictions, or equivalent validation.

Further Validation Required:

A reference to one of these APIs doesn't fail the test on its own. Inspect each reported code location using MASTG-TECH-0076 to determine whether the deserialized data can cross a trust boundary:

Uses of these APIs on constant, bundled, or otherwise trusted data that an attacker can't control should be reviewed manually rather than treated as a confirmed failure.

Tickets liés

Liens
is related to MASTG-BEST-0064 Use Safe APIs for Object Deserialization (iOS)