CWE-921, Storage of Sensitive Data in a Mechanism without Access Control, is about choosing the wrong place to put a secret. The product stores sensitive information in a file system or device that has no built-in access control.
How it happens
Many modern file systems restrict who can read a file. Not all storage does. MITRE lists memory cards, floppy disks, CDs and USB devices as typically accessible to any user on the system. In a multi-user environment, anybody can read or write what is stored there.
The mobile case matters most today. MITRE notes that on Android devices, external storage is typically globally readable and writable by other applications. It can also be reached through the phone's USB connection or its memory card port.
// Risky: external storage is readable by other apps
File f = new File(Environment.getExternalStorageDirectory(), "session.json");
// Safer: app-private internal storage
File g = new File(context.getFilesDir(), "session.json");
What an attacker gains
Confidentiality: attackers read sensitive information from the unrestricted storage. Integrity: they can modify or delete it.
How to find it
The MITRE record lists no detection methods. Search the code for writes to external or removable storage and review what data goes there. Check the manifest and storage calls of mobile apps first.
How to fix it
No formal mitigations are listed. Practical steps: keep sensitive data in app-private storage, do not write secrets or tokens to removable media, and if data must leave the private area, encrypt it first.
Quick check
Why is Android external storage a risk?
It is typically readable and writable by other applications on the device, so anything stored there is exposed to them.
