Case UC-01 · OWASP M1 Improper Credential Usage

Exposed push notification server key in a consumer app

A consumer app shipped the privileged server key of its push messaging provider inside the binary. Anyone who extracted it could address the app's entire audience, making this a platform-wide credential exposure rather than a single-user issue.

This article documents a representative, anonymised mobile application security case. It describes the weakness, why it matters to a business, how Mobexa detects it, and how to remediate it. No specific application, company or individual is identified.

Contents

  1. Context
  2. What the research team found
  3. Why it matters
  4. How Mobexa surfaces it
  5. Remediation
  6. Standards mapped

1 Context

A consumer app embedded the privileged server-side key of its push messaging provider directly in the shipped package, rather than keeping it on a backend. A mobile client only needs a client or sender token; the server key can address every device the project has ever registered, so it never belongs in a distributed binary.

2 What the research team found

Static review of the distributed package recovered the key from an application resource. With that single value, a third party could call the provider's send API and reach the app's full audience, set arbitrary notification titles and bodies, and trigger silent data messages that the app processes without user interaction.

3 Why it matters

One leaked value converts into platform-wide phishing, forced navigation to attacker-chosen destinations, and notification spam that erodes user trust and app-store standing. Because the credential is server-grade, rotation is the only remedy, and every already-shipped build stays exploitable until each user updates.

4 How Mobexa surfaces it

Mobexa fingerprints known credential formats - provider server keys, cloud access keys and signing secrets - across resources, strings, native libraries and assets, and reports each hit with its exact location and a redacted preview, flagged Critical under M1.

5 Remediation

Move all privileged messaging to a backend that holds the server key and ship only the client token to the app. Rotate the exposed key immediately, audit send history for abuse, and add a build-time secret scan to the release pipeline so a server credential can never reach a public artefact again.

6 Standards mapped

Table 1. Frameworks and references for this case
FrameworkReference
OWASP Mobile Top 10 (2024) M1 Improper Credential Usage
CWE CWE-798 Use of Hard-coded Credentials
OWASP MASVS MASVS-STORAGE and MASVS-AUTH
credentialspushsecrets

See also

Documented by the Mobexa research team. This case is anonymised and provided for educational use; the mapping references the OWASP Mobile Top 10 (2024).