From 8e6aac176c5ee689f495930356a66751d242629f Mon Sep 17 00:00:00 2001 From: Nouri-Anouar Date: Thu, 9 Jul 2026 19:25:40 +0100 Subject: [PATCH] Add KB entry for PII leaked in network traffic Existing LEAKING_PERSONAL_INFORMATION entry only covers PII found in local files/logs. This adds a sibling entry scoped to PII detected in HTTP request/response traffic, following the same pattern as LEAKING_CREDENTIALS_LOGS / LEAKING_CREDENTIALS_REQUEST. --- .../description.md | 65 +++++++++++++++++++ .../meta.json | 53 +++++++++++++++ .../recommendation.md | 63 ++++++++++++++++++ 3 files changed, 181 insertions(+) create mode 100644 MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/description.md create mode 100644 MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/meta.json create mode 100644 MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/recommendation.md diff --git a/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/description.md b/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/description.md new file mode 100644 index 00000000..7577527f --- /dev/null +++ b/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/description.md @@ -0,0 +1,65 @@ +Personally Identifiable Information (PII) is, according to NIST Special Publication 800-122, a collective term for any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information. + +In the context of mobile security, PII leakage in network traffic occurs when plain text PII is transmitted in an HTTP(S) request or response body, headers, or URL/query parameters, making it accessible to anyone able to observe the traffic: intermediate proxies, logging infrastructure, analytics/crash-reporting SDKs, or an attacker positioned on the network. + +=== "Kotlin" + ```kotlin + import okhttp3.OkHttpClient + import okhttp3.Request + import okhttp3.RequestBody + import okhttp3.MediaType.Companion.toMediaType + + val client = OkHttpClient() + + fun submitProfile(email: String, phoneNumber: String, ssn: String) { + // PII sent in plain text as URL query parameters and JSON body. + val json = """{"email":"$email","phone":"$phoneNumber","ssn":"$ssn"}""" + val body = RequestBody.create("application/json".toMediaType(), json) + val request = Request.Builder() + .url("https://api.example.com/profile?email=$email&ssn=$ssn") + .post(body) + .build() + + client.newCall(request).execute() + } + ``` + +=== "Swift" + ```swift + import Foundation + + func submitProfile(email: String, phoneNumber: String, ssn: String) { + // PII sent in plain text as URL query parameters and JSON body. + var components = URLComponents(string: "https://api.example.com/profile")! + components.queryItems = [ + URLQueryItem(name: "email", value: email), + URLQueryItem(name: "ssn", value: ssn) + ] + + var request = URLRequest(url: components.url!) + request.httpMethod = "POST" + request.httpBody = try? JSONSerialization.data(withJSONObject: [ + "email": email, + "phone": phoneNumber, + "ssn": ssn + ]) + + URLSession.shared.dataTask(with: request).resume() + } + ``` + +=== "Flutter" + ```dart + import 'package:http/http.dart' as http; + import 'dart:convert'; + + Future submitProfile(String email, String phoneNumber, String ssn) async { + // PII sent in plain text as URL query parameters and JSON body. + final uri = Uri.parse('https://api.example.com/profile?email=$email&ssn=$ssn'); + + await http.post( + uri, + body: jsonEncode({'email': email, 'phone': phoneNumber, 'ssn': ssn}), + ); + } + ``` diff --git a/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/meta.json b/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/meta.json new file mode 100644 index 00000000..086f2a1c --- /dev/null +++ b/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/meta.json @@ -0,0 +1,53 @@ +{ + "risk_rating": "medium", + "short_description": "Personally Identifiable Information were detected leaked in network traffic.", + "references": { + "CWE-200: Information Exposure": "https://cwe.mitre.org/data/definitions/200.html", + "CWE-359: Exposure of Private Information (\"Privacy Violation\")": "https://cwe.mitre.org/data/definitions/359.html", + "CWE-598: Information Exposure Through Query Strings in GET Request": "https://cwe.mitre.org/data/definitions/598.html" + }, + "title": "Personally Identifiable Information (PII) Leakage in Network Traffic", + "privacy_issue": true, + "security_issue": false, + "categories": { + "OWASP_MASVS_L1": [ + "MSTG_ARCH_12", + "MSTG_NETWORK_1" + ], + "OWASP_MASVS_L2": [ + "MSTG_ARCH_12", + "MSTG_NETWORK_1" + ], + "GDPR": [ + "ART_32", + "ART_25" + ], + "PCI_STANDARDS": [ + "REQ_3_2", + "REQ_3_3", + "REQ_3_5", + "REQ_3_6", + "REQ_3_7", + "REQ_4_2", + "REQ_6_2" + ], + "OWASP_MASVS_v2_1": [ + "MASVS_STORAGE_1", + "MASVS_STORAGE_2", + "MASVS_NETWORK_1" + ], + "SOC2_CONTROLS": [ + "CC_2_1", + "CC_4_1", + "CC_7_1", + "CC_7_2", + "CC_7_4", + "CC_7_5" + ], + "HIPAA_CONTROLS": [ + "SECURITY251", + "SECURITY212", + "SECURITY213" + ] + } +} diff --git a/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/recommendation.md b/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/recommendation.md new file mode 100644 index 00000000..0edd3891 --- /dev/null +++ b/MOBILE_CLIENT/COMMON/_MEDIUM/LEAKING_PERSONAL_INFORMATION_REQUEST/recommendation.md @@ -0,0 +1,63 @@ +* Avoid transmitting PII/PHI in URL query parameters; use the request body instead, since URLs are commonly logged by proxies, load balancers, and browser history. +* Always transmit PII/PHI over an encrypted channel (TLS), never in plain text. +* Minimize the amount of PII sent to the backend to what is strictly necessary for the request. +* Mask or redact PII before sending it to third-party analytics, crash-reporting, or logging SDKs. +* Do not echo PII back in error messages or debug responses. +* Some jurisdictions may require you to provide a privacy policy for transmitting personal information, and to obtain explicit user consent before sending it off-device. +* If a backend integration requires PII, ensure it is only sent to first-party, trusted endpoints, and validate third-party SDKs are not silently forwarding it elsewhere. + +=== "Kotlin" + ```kotlin + import okhttp3.OkHttpClient + import okhttp3.Request + import okhttp3.RequestBody + import okhttp3.MediaType.Companion.toMediaType + + val client = OkHttpClient() + + fun submitProfile(email: String, phoneNumber: String, ssn: String) { + // PII sent only in the encrypted request body, not in the URL. + val json = """{"email":"$email","phone":"$phoneNumber","ssn":"$ssn"}""" + val body = RequestBody.create("application/json".toMediaType(), json) + val request = Request.Builder() + .url("https://api.example.com/profile") + .post(body) + .build() + + client.newCall(request).execute() + } + ``` + +=== "Swift" + ```swift + import Foundation + + func submitProfile(email: String, phoneNumber: String, ssn: String) { + // PII sent only in the encrypted request body, not in the URL. + var request = URLRequest(url: URL(string: "https://api.example.com/profile")!) + request.httpMethod = "POST" + request.httpBody = try? JSONSerialization.data(withJSONObject: [ + "email": email, + "phone": phoneNumber, + "ssn": ssn + ]) + + URLSession.shared.dataTask(with: request).resume() + } + ``` + +=== "Flutter" + ```dart + import 'package:http/http.dart' as http; + import 'dart:convert'; + + Future submitProfile(String email, String phoneNumber, String ssn) async { + // PII sent only in the encrypted request body, not in the URL. + final uri = Uri.parse('https://api.example.com/profile'); + + await http.post( + uri, + body: jsonEncode({'email': email, 'phone': phoneNumber, 'ssn': ssn}), + ); + } + ```