ATS Exception Low TLS Version

ID

swift.ats_exception_low_tls_version

Severity

high

Remediation Complexity

trivial

Remediation Risk

medium

Remediation Effort

medium

Resource

Information Leak

Language

Swift

Tags

ASVS50:v12.2.1, ASVS50:v12.3.1, ASVS50:v12.3.3, ASVS50:v4.4.1, ASVS50:v4.4.4, CWE:319, MASVS:MSTG-NETWORK-2, OWASP:2025:A06

Description

Each child dictionary of NSAppTransportSecurity.NSExceptionDomains relaxes App Transport Security (ATS) for the named host. Setting NSExceptionMinimumTLSVersion to TLSv1.0 or TLSv1.1 lets the app negotiate deprecated protocol versions known to be vulnerable to BEAST, POODLE and downgrade attacks.

<key>NSAppTransportSecurity</key>
<dict>
    <key>NSExceptionDomains</key>
    <dict>
        <key>legacy.example.com</key>  <!-- FLAW -->
        <dict>
            <key>NSExceptionMinimumTLSVersion</key>
            <string>TLSv1.0</string>
        </dict>
    </dict>
</dict>

Rationale

TLS 1.0 and 1.1 have been deprecated by RFC 8996 and removed from every major browser. Apple’s ATS defaults to TLSv1.2 — a per-domain downgrade is almost always a workaround for legacy infrastructure that should be modernised, not preserved in the binary.

Remediation

Remove the NSExceptionMinimumTLSVersion entry (which restores the TLSv1.2 default) or set it to TLSv1.2 / TLSv1.3. Upgrade the upstream server’s TLS stack to support modern cipher suites.

References