DerScanner
Home / Vulnerability Database / Android : Debug mode on
Android

Android : Debug mode on

Classification

OWASP Mobile Top 10 2014
M4-Unintended Data Leakage
OWASP Mobile Top 10 2016
M2-Insecure Data Storage
OWASP MASVS
V7: 7.2.(L1/L2/L1+R/L2+R)V8: 8.2.(L1+R/L2+R)
PCI DSS 4.0
10.3
CWE
CWE-215

Overview

The launch of the application in debug mode is possible, which can lead to data confidentiality loss.

The BuildConfig.DEBUG variable, which is responsible for enabling the debug mode, is set to true. This variable is created automatically by Eclipse IDE with the ADT plugin. Because of incorrect work of ADT it can retain the true value in release build of the application.

References

  1. ADT Plugin - developer.android.com
  2. Be Careful With BuildConfig.DEBUG - Kevin / Digiprom
  3. When does ADT set BuildConfig.DEBUG to false? - stackoverflow.com
  4. BuildConfig.DEBUG override to true for release build? - stackoverflow.com
  5. CWE-215
MEDIUM

DerScanner Severity Score

Do you want to fix Android : Debug mode on in your application?

See also

Android

Android : Error handling: generic exception

Android

Android : HTTP usage

Android

Android : Visible password