1

I am working on an android application and the company request is to be able to potentially have a user edit the API URL the app uses to be able to work with different test environments.

This immediately threw up a red flag for me as this might lead an attacker putting in some bad URL (if they knew how to enable the ability to change the API URL) and do something bad to the device.

I have no security background so I dont know if this is of any concern but I feel like this can be abused some how whether it be a device exploit or other.

I tried pushing back and saying its not a good idea but they seem fixated on having it editable and I have nothing to back me up as proof that this is a bad idea.

Should I be concerned about having going down this route?

1

This is a good thing to ask questions about. The answer will come down to how this API URL is used; ie whether it's used client-side or server-side.

Client-side

Is this a URL used by the Android app to connect to the server?

Client fetching a URL

Then from the server's perspective, this is fine. It's the same as someone extracting auth credentials from the app and calling this API from curl or Postman. Since this a threat the server should protect against anyway, I would hope that there is appropriate authentication and authorization already in place to block anything un-authorized access here.

One place you might do some poking is how the app handles the response from this API. For example, if the app is expecting a response from API1, but the user tricks it into calling API2 instead, will the response data from API2 cause unexpected behaviour in the client?

Generally though, if this URL is used by the client, I don't see this being a big deal.

Server-side

Is this URL passed up to the server, and the server connects to it?

Server fetching a client-provided URL

This situation is almost certainly wrong, and is almost certainly vulnerable to Server-Side Request Forgery (SSRF).

If this is the case, then the whole design of this API should be looked at carefully.

4
  • Yeah the app connects directly to the server, I was concerned that someone could put in a url like www.mybadurl.com that could potentially download and install something or get sensitive information some how
    – tyczj
    Dec 10 '19 at 15:56
  • That's a fair thing to ask about. It's worth taking a look in the code to see what the app does with the response data for that API call, and asking yourself what unexpected behaviour you can cause by malforming the response data. At worst this sounds like a case of the user hacking their own phone though right? If you can find a way that a user entering www.mybadurl.com into the app will affect other users, then you have a real problem. Dec 10 '19 at 16:03
  • Unless they go their hands on someone else's phone some how yes it would be their own phone. My concern wasn't really about effecting people in-mass just in general and trying to b a good developer :)
    – tyczj
    Dec 10 '19 at 16:53
  • I agree that letting the user set an internal URL makes the app brittle and easy to break, but I'm not sure it's a security issue. Dec 10 '19 at 18:07
1

Should I be concerned about having going down this route?

Not really. There are so many ways for someone to submit modified URLs to your server that, if making the field non-editable in your app is your protection, then you're in deep trouble.

For example, a user could use a special tool like Postman. A user could set up a Burp proxy to intercept and edit the requests. A user could implement their own client in Python or some other flexible language.

The application you publish is just one entry point to your service. Focus instead on making the service resilient to unanticipated inputs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.