Security Issue: HIGH RISK vulnerables using OneSignal SDK

[faisalmohd83]

Description:
Below issues are reported as HIGH RISKs while Mobile Application Security Test. Appreciate it if the below issues can be addressed. Thanks.

1. EXTERNAL DATA IN SQL QUERIES
   Inclusion of input into raw SQL queries can potentially lead to a local SQL injection vulnerability in the mobile application.
   The correct approach is to use prepared SQL statements beyond user's control.
   Some of it:
   There is 'rawQuery()' found in file 'com/onesignal/OneSignalDbHelper.java':
   Cursor rawQuery = sQLiteDatabase.rawQuery("SELECT name FROM sqlite_master WHERE type='table'", null);
   --
   also, There is 'execSQL()' found in file 'com/onesignal/outcomes/OSOutcomeTableProvider.java':
   sQLiteDatabase.execSQL(stringBuilder.toString());
sQLiteDatabase.execSQL("DROP TABLE outcome;");
sQLiteDatabase.execSQL(SQL_CREATE_OUTCOME_ENTRIES_V2);

2. CLEARTEXT SQLITE DATABASE
   The mobile application uses an unencrypted SQLite database.
   This database can be accessed by an attacker with physical access to the mobile device or a malicious application with
   root access to the device. The application should not store sensitive information in cleartext.

Environment

1. Android SDK: Android 11
2. OneSignal SDK: 4+
3. Add OneSignal using Maven

Steps to Reproduce Issue:

1. Add the OneSignal SDK to your project
2. Place your App ID in the application's Gradle file
3. Run the Mobile Application Security Test

--

[jkasten2]

@faisalmohd83 Thanks for reporting this issue. We have reviewed the code and we not able to find any SQL injection vulnerabilities in the code. The local database for OneSignal is not encrypted but other apps can't access due to the permissions and location of the SQL database.

However we will look into seeing what we can do to add a SQL injection test to our CI pipeline to ensure we continue to ensure this isn't a future issue.

[yasht01]

Hey @jkasten2 this was reported by the SecOps team for our app too. Can you share any update for these SQL injection vulnerabilities?

[chardskarth]

Hi everyone, this was also reported to us by our VA team, would kindly appreciate a feedback about this issue.

Btw, Awesome opensource project 🎉!

[jsellam]

Hi everyone, this was also reported to us by our VA team, would kindly appreciate a feedback about this issue.

Btw, Awesome opensource project 🎉!

there is a new answer : OneSignal/react-native-onesignal#1780 (comment)