Valentin271 / DeezerKodi

Deezer client for Kodi
GNU General Public License v3.0
24 stars 4 forks source link

[Security] user credentials could be easily retrieved #29

Open knacky34 opened 1 year ago

knacky34 commented 1 year ago

Describe the bug
The user login is transmitted via unsecured HTTP to tv.deezer.com. So plain text email address and a MD5 hash of the password are transmitted. However MD5 is not a strong hash function as it could be easily reversed.

Environment (optional if log file provided) :

Steps to reproduce
1) Open Wireshark (or any packet interception app) and start capture 1) Open Kodi and try authenticate to Deezer 1) You should be able to view the corresponding packet in Wireshark with endpoint : http://tv.deezer.com/smarttv/authentication.php 1) Now you have access to the user email its hashed password

Packet in Wireshark

How to resolve Please consider using HTTPS and if possible SHA256 hash. You might also enable HTTPS for the streaming.php endpoint.