MSAL - Xamarin Forms - iOS and Android - Penetration Test - Password is disclosed in the process where app is running

Question

Baluprasath Sampath Kumar 1

Hi,

We have implemented the MSAL authentication with EmbeddedWebView for Xamarin Forms Mobile app(iOS and Android).

The issue is when the app is penetration tested, they could find the password is being saved inside the app process and it can be easily retrieved.

MSAL library exposing sensitive information to the attackers.

Would be helpful if it is addressed earlier ASAP.

Regards,
Baluprasath S

Shashi Shailaj 7,636 Reputation points Microsoft Employee Moderator

2021-04-07T08:41:42.55+00:00

@Baluprasath Sampath Kumar , Thank you for sharing your findings. Could you please let me know what oAuth flows you are using while the password is being saved in the app process?
Baluprasath Sampath Kumar 1 Reputation point

2021-04-08T03:19:45.98+00:00

Hi @Shashi Shailaj ,

Thanks for your email.

MSAL library internally does it choosing the oAuth flow(correct me if I am wrong) because there is no config or code written to specify the oAuth flow. It should be Authorization Code oAuth flow (but not sure).

But the authentication is interactive where user needs to enter their own email and password.

The implementation would be similar as in the below link,
https://damienaicheh.github.io/azure/xamarin/xamarin.forms/2019/07/01/sign-in-with-microsoft-account-with-xamarin-en.html

Regards,
Baluprasath S

Your answer

Shashi Shailaj 7,636 Reputation points Microsoft Employee Moderator

2021-04-07T08:41:42.55+00:00

@Baluprasath Sampath Kumar , Thank you for sharing your findings. Could you please let me know what oAuth flows you are using while the password is being saved in the app process?
Baluprasath Sampath Kumar 1 Reputation point

2021-04-08T03:19:45.98+00:00

Hi @Shashi Shailaj ,

Thanks for your email.

MSAL library internally does it choosing the oAuth flow(correct me if I am wrong) because there is no config or code written to specify the oAuth flow. It should be Authorization Code oAuth flow (but not sure).

But the authentication is interactive where user needs to enter their own email and password.

The implementation would be similar as in the below link,
https://damienaicheh.github.io/azure/xamarin/xamarin.forms/2019/07/01/sign-in-with-microsoft-account-with-xamarin-en.html

Regards,
Baluprasath S