Home / Attacks & tests / Execution of Untrusted Code Vulnerabilities
11 test cases
Execution of Untrusted Code Vulnerabilities
iOS forbids loading new executable code at runtime, so this category is narrower than its Android counterpart and concentrates where untrusted content still reaches an interpreter: web views and their native bridges, interpreted configuration, and the memory-handling defects in the substantial amount of C and Objective-C beneath most applications.
What an attacker is trying to achieve
The attacker wants their content evaluated inside the application. With arbitrary code loading closed off, the routes that remain are a web view that loads content they control, a bridge that exposes native capability to it, and a parser that mishandles a crafted file.
Test cases
11 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
IOS-CODE-01 WebView Security
Objective — Determine how the application's web views are configured and what content they can be made to load.
How it is tested — Enumerate every web view and record its configuration: script execution, local file access, whether arbitrary destinations may be loaded, and whether transport security exceptions apply to it. Establish which destinations each can be made to load, including through link parameters the application accepts from outside. Determine whether the deprecated web view class is still in use, and whether certificate validation is relaxed for it.
Prerequisites — The decrypted binary; the bundle's transport security configuration; a device; a proxy; a destination the tester controls.
Indicators — A web view loading a caller-supplied destination; local file access enabled alongside remote content; a transport security exception covering the view; relaxed certificate validation.
Coverage — MASVS-PLATFORM-2MASVS-NETWORK-1CWE-749CWE-295
Depth — Manual Configuration is read from the binary and confirmed by loading real content into the view.
IOS-CODE-02 Native Interfaces Exposed to WebView Content
Objective — Determine what native capability is exposed to content running in a web view, and whether that content can originate outside the application.
How it is tested — Enumerate the message handlers and injected scripts registered on each web view and establish what each can do — read the container, issue authenticated requests, return keychain material, invoke device features. Then establish whether any content the view loads can come from outside: a link parameter, an intercepted plaintext load, or third-party content embedded in a trusted page.
Prerequisites — The decrypted binary; a device; the ability to serve content into the view by parameter or interception.
Indicators — A message handler exposing container or keychain access; a handler registered on a view that loads remote content; third-party content reaching a bridged view.
Coverage — MASVS-PLATFORM-2MASVS-CODE-4CWE-749CWE-94
Depth — Manual The finding is a capable bridge plus reachable content; neither alone is one.
IOS-CODE-03 JavaScript Execution Risks in WebViews
Objective — Determine whether content rendered in a web view can carry script supplied by another user or by an attacker.
How it is tested — Identify what the application renders in web views — user-generated content, server-delivered markup, help and terms pages, message bodies — and submit script payloads into each. Establish whether the application encodes before rendering and whether the view executes script. Where it does, determine what the script reaches: registered message handlers, local files, and any session material the view carries.
Prerequisites — A device; content-submission paths reaching a web view; a second account so content is rendered to another user.
Indicators — Script from submitted content executing in a web view; markup rendered unencoded; executing script reaching a message handler or local file.
Coverage — MASVS-PLATFORM-2MASVS-CODE-4CWE-79CWE-749
Depth — Manual Requires driving content through the application into the view rather than testing the view directly.
IOS-CODE-04 Code Signing and Integrity
Objective — Determine whether the application detects having been modified or re-signed, and whether the server can distinguish a genuine client from a repackaged one.
How it is tested — Examine the signature and entitlements of the distributed bundle. Re-sign the application with a different identity, install it on a device that permits this, and establish whether it runs unchanged. Determine whether the application verifies its own signature or entitlements at runtime and what it does on failure, and whether any attestation is sent to and checked by the server.
Prerequisites — The distributed bundle; re-signing tooling and a device permitting installation outside the store; a proxy to observe server behaviour.
Indicators — A re-signed application running unchanged; no runtime integrity check, or one that only warns; the server unable to distinguish a modified client; development entitlements in the release build.
Coverage — MASVS-RESILIENCE-1MASVS-RESILIENCE-2CWE-347CWE-494
Depth — Manual Confirmation is re-signing and running, which cannot be inferred from the bundle alone.
IOS-CODE-05 Dynamic Code Execution Decisions
Objective — Determine whether behaviour driven by server-delivered configuration or interpreted rules can be influenced to change what the application does.
How it is tested — Identify configuration, feature flags and rule data the application interprets rather than merely displays, whether delivered from the server or held in the container. Modify it in transit through a proxy and at rest on the device, and observe whether behaviour changes. Establish whether such data is integrity-protected and whether it can enable functionality meant to stay disabled or turn off a control meant to stay on.
Prerequisites — A proxy able to modify responses; a device with container access; the decrypted binary to identify interpreted data.
Indicators — Behaviour changing from modified configuration; a security control disabled by a flag the client accepts; interpreted rules delivered without integrity protection.
Coverage — MASVS-CODE-4MASVS-RESILIENCE-1CWE-494CWE-807
Depth — Manual Requires distinguishing configuration the client obeys from data it merely renders.
IOS-CODE-06 Stack-Based Buffer Overflows
Objective — Determine whether native code beneath the application mishandles input exceeding the stack buffers allocated for it.
How it is tested — Identify the native code reached by application data — media decoding, cryptography, compression, protocol and document parsing — and submit oversized values through each path, increasing length progressively. Observe for termination rather than rejection, and read the resulting crash report to establish whether the fault reflects submitted content. Review the disassembly for unbounded copy operations.
Prerequisites — The decrypted binary and a disassembler; a device where crashes can be observed and reports retrieved; permission to crash the application.
Indicators — Termination at a length threshold; a crash report whose fault address reflects submitted content; an unbounded copy into a fixed buffer in the disassembly.
Coverage — MASVS-CODE-4CWE-121CWE-787
Depth — Manual Requires reaching native code through the application's own data paths and reading crash reports.
IOS-CODE-07 Heap-Based Buffer Overflows
Objective — Determine whether native components mishandle dynamically allocated memory through inconsistent declared sizes or arithmetic that does not hold.
How it is tested — Target native code allocating from values taken from input: image and media dimensions, declared record counts, decompressed sizes. Submit inputs whose declared size disagrees with the content that follows, and values chosen to make an allocation calculation wrap. Observe for corruption and termination rather than clean rejection, and correlate crash reports against the allocating routine.
Prerequisites — The decrypted binary and a disassembler; a device permitting crash observation; sample files whose headers can be edited independently of content.
Indicators — A crash within allocation or copy routines; a declared size trusted without reconciliation; corrupted output rather than refusal.
Coverage — MASVS-CODE-4CWE-122CWE-787
Depth — Manual Requires reasoning about allocation from outside the process, guided by the disassembly.
IOS-CODE-08 Object Lifetime Vulnerabilities
Objective — Determine whether native or reference-counted objects are used after release, or released more than once, under sequences the application can be driven to produce.
How it is tested — Identify operations with an explicit lifecycle — open and close, start and cancel, subscribe and remove — and drive them in orders the interface does not produce: cancel during processing, close twice, reuse a handle after release, background the application mid-operation. Concentrate on error and cancellation paths, where cleanup is most often duplicated or omitted, and on manually managed native objects.
Prerequisites — The decrypted binary; a device permitting crashes and report retrieval; the ability to interrupt operations, including by removing connectivity.
Indicators — A crash following cancellation or repeated release; behaviour depending on memory state rather than input; instability after an interrupted operation.
Coverage — MASVS-CODE-4CWE-416CWE-415
Depth — Manual The triggering sequences are orderings the interface never produces and must be constructed deliberately.
IOS-CODE-09 Format String Vulnerabilities
Objective — Determine whether externally supplied strings reach formatting functions as the format specification rather than as an argument.
How it is tested — Identify logging and string-construction paths receiving application data, including the platform's own formatting facilities where a non-constant format argument is passed. Submit format specifiers through every field reaching them and observe whether they are rendered literally or interpreted. Review the disassembly for formatting calls whose format argument is not a literal.
Prerequisites — The decrypted binary and a disassembler; a device with log access; fields whose values reach formatting calls.
Indicators — A specifier interpreted rather than displayed; memory content or pointer-like values in output; a crash on specifier submission; a non-constant format argument in the disassembly.
Coverage — MASVS-CODE-4CWE-134
Depth — Manual Confirmation usually requires reading the log rather than the interface.
IOS-CODE-10 Integer Overflows
Objective — Determine whether arithmetic on caller-influenced values overflows in the parts of the application where the language does not trap on it.
How it is tested — Swift traps on overflow by default, so the productive ground is elsewhere: Objective-C and C code, Swift's deliberately unchecked operators, and the bridging boundary where a platform-width integer is narrowed to a fixed-width type for a C API. Identify those boundaries in the disassembly and submit values near the type limits through each. Concentrate on arithmetic preceding an allocation or a bounds check.
Prerequisites — The decrypted binary and a disassembler; a device permitting crashes and crash-report retrieval; input paths carrying numeric values into Objective-C or C.
Indicators — A trap or crash at a numeric boundary in Swift code; silent wrapping in Objective-C or C; a narrowing conversion at a bridging boundary; a bounds check passing for a value that wrapped.
Coverage — MASVS-CODE-4CWE-190CWE-680
Depth — Manual The productive values sit at type boundaries, which requires knowing the types from the disassembly.
IOS-CODE-11 Integer Underflows
Objective — Determine whether subtraction on caller-influenced values falls below zero in unsigned or C-typed arithmetic, producing a very large length where a small one was expected.
How it is tested — Concentrate on the platform's own count and length types, which are unsigned and appear throughout collection, data and string handling: a subtraction on a byte count that goes negative becomes an enormous positive value rather than an error. Identify such subtractions in the disassembly, particularly remaining-length calculations over a data buffer, and submit content whose declared length is smaller than the header or prefix it describes.
Prerequisites — The decrypted binary and a disassembler; a device permitting crashes and report retrieval; sample data whose declared lengths can be edited independently of content.
Indicators — An enormous length derived from a small input; a crash reading past the end of a data buffer; a declared length below its header size accepted; a range operation on an unsigned count that wrapped.
Coverage — MASVS-CODE-4CWE-191CWE-125
Depth — Manual Requires identifying which subtractions feed a length, which comes from the disassembly.
What we need from you
A decrypted binary and disassembler; a device permitting instrumentation and crash observation; a proxy with interception for the web view cases; and permission to crash the application.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- MASVS-PLATFORM-2 — The app uses WebViews securely.
- MASVS-NETWORK-1 — The app secures all network traffic according to the current best practices.
- CWE-749 — Exposed Dangerous Method or Function
- CWE-295 — Improper Certificate Validation
- MASVS-CODE-4 — The app validates and sanitizes all untrusted inputs.
- CWE-94 — Improper Control of Generation of Code ('Code Injection')
- CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- MASVS-RESILIENCE-1 — The app validates the integrity of the platform.
- MASVS-RESILIENCE-2 — The app implements anti-tampering mechanisms.
- CWE-347 — Improper Verification of Cryptographic Signature
- CWE-494 — Download of Code Without Integrity Check
- CWE-807 — Reliance on Untrusted Inputs in a Security Decision
- CWE-121 — Stack-based Buffer Overflow
- CWE-787 — Out-of-bounds Write
- CWE-122 — Heap-based Buffer Overflow
- CWE-416 — Use After Free
- CWE-415 — Double Free
- CWE-134 — Use of Externally-Controlled Format String
- CWE-190 — Integer Overflow or Wraparound
- CWE-680 — Integer Overflow to Buffer Overflow
- CWE-191 — Integer Underflow (Wrap or Wraparound)
- CWE-125 — Out-of-bounds Read
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.