Mobile frameworks such as Flutter, React Native, Cordova, and .NET MAUI promise efficient cross-platform development. A shared code base enables faster development and maintenance of iOS and Android applications.
However, these benefits also introduce new security requirements. Each framework comes with its own architecture, components, and configuration options. Misconfigurations, insecure data storage, or insufficiently protected code can create additional attack surfaces for attackers.
In Mobile App Pentests, our security analysts regularly encounter recurring vulnerabilities. Notably, the root cause is usually not the framework itself, but rather its configuration and use. Using Cordova, Flutter, React Native, and .NET MAUI as examples, this article highlights the vulnerabilities our analysts repeatedly encounter and the aspects developers should therefore pay particular attention to.
Cordova: When Web Application Vulnerabilities Become Mobile App Vulnerabilities
Cordova takes a unique approach: applications are largely developed using web technologies such as HTML, CSS, and JavaScript and run within a native WebView. This enables web developers to build mobile applications with relative ease.
From a security perspective, however, this introduces a particular risk: vulnerabilities in the web application can directly impact the mobile application. Cross-Site Scripting (XSS) vulnerabilities are especially critical. If malicious JavaScript is injected into the application, it may be able to access native device functionality through Cordova plugins, provided the necessary permissions are granted. This can include access to location data, the camera, or the file system.
One example is access to location data through the Geolocation API:
navigator.geolocation.getCurrentPosition(
function (position) {
console.log("Latitude:", position.coords.latitude);
console.log("Longitude:", position.coords.longitude);
console.log("Accuracy (meters):", position.coords.accuracy);
},
function (error) {
console.error("Location error:", error);
},
{
enableHighAccuracy: true,
timeout: 5000,
maximumAge: 0
}
);
If an XSS vulnerability is exploited, malicious JavaScript may be able to interact with the same interfaces as the legitimate application code.
What Developers Should Pay Attention to When Using Cordova
1. Secure the config.xml Configuration
The config.xml file defines key security settings for the WebView. Overly permissive configurations of access, allow-navigation, or allow-intent can enable unwanted network connections, the loading of external content, or the execution of Android intents. The risk increases significantly, particularly when combined with XSS vulnerabilities.
2. Restrict File and Plugin Access
Insecure settings such as AllowUniversalAccessFromFileURLs or AndroidInsecureFileModeEnabled can bypass protections provided by the Same Origin Policy. As a result, local files, stored tokens, or databases may become accessible. Third-party plugins should also be reviewed regularly for security risks.
Special Consideration: Cordova does not provide native certificate pinning. Developers should therefore implement additional measures to make man-in-the-middle attacks against server communications more difficult.
Flutter: High Performance Requires Additional Security Considerations
Flutter has established itself as one of the most popular cross-platform frameworks. Applications are developed in Dart and compiled for both Android and iOS, resulting in high performance and a largely native user experience.
What Developers Should Pay Attention to When Using Flutter
1. Do Not Store Sensitive Data Insecurely
Flutter does not provide built-in secure storage functionality for sensitive data.
Credentials, tokens, and API keys should therefore be stored using a plugin such as flutter_secure_storage. Rather than relying on general purpose storage mechanisms such as SharedPreferences or NSUserDefaults, it leverages the platforms' native security features, including Android Keystore and iOS Keychain.
2. Make Reverse Engineering More Difficult
Once released, mobile applications can be analyzed and, to some extent, reconstructed. Flutter provides the option to obfuscate application code during the build process. While obfuscation does not improve the security of the business logic itself, it makes application analysis significantly more difficult for attackers.
The feature can be enabled directly during the build process:
flutter build apk --release --obfuscate
For applications deployed to production, developers should consider making this measure part of the build process.
React Native: Securely Integrating Native Components
React Native bridges JavaScript code with native platform functionality. This enables efficient development of applications for multiple operating systems. At the same time, it introduces security requirements for the libraries and interfaces used.
What Developers Should Pay Attention to When Using React Native
1. Store Sensitive Data Securely
React Native also does not provide a built-in solution for securely storing sensitive data.
For credentials or tokens, a suitable library such as react-native-keychain should therefore be used. Rather than storing sensitive information in general purpose storage mechanisms such as AsyncStorage, these libraries leverage the platforms' native security features, including Android Keystore and iOS Keychain.
2. Configure WebViews Carefully
Many applications use the react-native-webview library to embed web content. Misconfigurations can result in unwanted content being loaded or local resources becoming accessible. Particular attention should be paid to settings such as originWhitelist, allowFileAccess, and mixedContentMode.
For example, a restrictive configuration might look like this:
<WebView
originWhitelist={['https://api.example.com']}
mixedContentMode="never"
/>
.NET MAUI: Security Starts with Application Code
.NET MAUI is the successor to Xamarin and enables the development of cross-platform applications using C# and .NET within the Microsoft ecosystem. Unlike frameworks such as Cordova, it does not introduce particularly distinctive framework specific attack surfaces.
As a result, the primary focus is on the quality and security of the application code.
What Developers Should Pay Attention to When Using .NET MAUI
Secure Storage of Sensitive Information
For credentials, tokens, or certificates, .NET MAUI provides a built-in solution through SecureStorage. It leverages the native protection mechanisms of Android Keystore and iOS Keychain, eliminating the need for developers to implement their own storage solutions.
In addition, the established principles of secure software development still apply: validate user input, avoid storing secrets in source code, and keep third-party libraries up to date.
A Secure Framework Is Only Half the Story
Whether Cordova, Flutter, React Native, or .NET MAUI, each framework comes with its own strengths and security relevant characteristics. While the focus in Cordova is primarily on the WebView and its configuration, secure data storage and protection against reverse engineering play an important role in Flutter and React Native. In .NET MAUI, the emphasis is largely on the secure implementation of application logic.
The experience of our pentest professionals shows that critical vulnerabilities rarely stem from the framework itself. Far more often, they result from insecure configurations, inadequately protected sensitive data, or security mechanisms that are not used consistently, such as when developers incorrectly assume that a framework’s default storage mechanisms are suitable for storing tokens or credentials. Organizations that understand the specific characteristics of their chosen framework and address them early can significantly reduce their application’s attack surface.
Looking to improve the security of your mobile application? Contact us.
