Case UC-04 · OWASP M5 Insecure Communication

Disabled certificate validation in an app network layer

A networking layer accepted any server certificate, a development shortcut left in the release build. On a hostile network it allowed full interception and modification of the app's API traffic.

This article documents a representative, anonymised mobile application security case. It describes the weakness, why it matters to a business, how Mobexa detects it, and how to remediate it. No specific application, company or individual is identified.

Contents

  1. Context
  2. What the research team found
  3. Why it matters
  4. How Mobexa surfaces it
  5. Remediation
  6. Standards mapped

1 Context

A networking layer was configured to accept any server certificate - an override commonly introduced during development to silence errors against a test endpoint, then shipped to production unchanged. The setting disables the core guarantee that the app is talking to the real server.

2 What the research team found

The team identified a trust-all configuration in the network stack, combining a permissive trust manager with a disabled hostname check. On a hostile network, a position-in-the-middle party can present any certificate and read or alter requests and responses transparently to the user.

3 Why it matters

Disabling validation defeats transport security entirely. Credentials, tokens and personal data flow in readable form to an interceptor, and tampered responses can drive the app into unsafe states. The defect is silent in normal use and only manifests under an active attack, so it routinely survives functional testing.

4 How Mobexa surfaces it

Mobexa proxies app traffic during a dynamic run, detects permissive trust configurations and absent certificate pinning, and confirms whether sensitive endpoints can actually be intercepted, reporting the result under M5.

5 Remediation

Remove all trust overrides from release builds, enforce platform certificate validation, and add pinning for high-value endpoints. Gate any development-only network relaxations behind build flags that cannot reach a production artefact.

6 Standards mapped

Table 1. Frameworks and references for this case
FrameworkReference
OWASP Mobile Top 10 (2024) M5 Insecure Communication
CWE CWE-295 Improper Certificate Validation
OWASP MASVS MASVS-NETWORK
tlsnetworkmitm

See also

Documented by the Mobexa research team. This case is anonymised and provided for educational use; the mapping references the OWASP Mobile Top 10 (2024).