NowSecure static analysis: Outdated Version of Network Library Potentially Exposes Network Traffic to Interception and Modification

lcimeni commented 3 years ago

Finding Description

The application was found to be using a vulnerable version of the OkHttp library. This indicates that an attacker could bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers on the same local or upstream network to bypass certificate pinning and potentially intercept and modify network data.

Steps to Reproduce

During static analysis, the binary is searched for vulnerable versions of the third-party library OkHTTP.

Business Impact

The app is using a 3rd party library to communicate which is not secure. A malicious actor could remotely see and modify information coming to and from the app, potentially from multiple users at once.

Remediation Resources

Update the version of OkHttp used in the application to 4+.

Risk and Regulatory Information

Severity: medium CVSS: 5.9

CWE: 295
FISMA LOW: SC-13 CRYPTOGRAPHIC PROTECTION, AC-22 PUBLICLY ACCESSIBLE CONTENT
FISMA MED: SC-8 TRANSMISSION CONFIDENTIALITY AND INTEGRITY
Risk OWASP: Mobile Top 10: M3-Insecure Communication
GDPR: Risks violating Article 25, Risks violating Article 32
FFIEC: May violate D3.PC.Am.Int.7
PCI: May violate requirement 4.1
HIPAA: May violate §164.312(e)(1): Standard: Transmission security.
CCPA: Risks violating CCPA: exfiltration, theft, or disclosure of PII
CWE Top 25: 2019 CWE Top 25 Most Dangerous Software Errors

Application

Platform: android
Package: fuzion24.dynamictestapp

See more detail in the NowSecure Report

lcimeni commented 3 years ago

Update: This finding has been marked as ‘Pass’ by Lorenz Cimeni, so no additional action required.

Powered by NowSecure Platform

lcimeni commented 3 years ago

Update: This finding has been permanently hidden by Lorenz Cimeni, so no additional action required.

Powered by NowSecure Platform

lcimeni commented 3 years ago

Update: The risk severity (CVSS score) of this finding has been modified from 5.9 to 8.88 by Lorenz Cimeni.

Powered by NowSecure Platform

lcimeni commented 3 years ago

Update: The risk severity (CVSS score) of this finding has been modified from 8.88 to 8.8888 by Lorenz Cimeni.

Powered by NowSecure Platform

lcimeni / youtube