This urgent security advisory is about to describe a Major vulnerability discovered during the security assessment of Morocco’s COVID-19 Mobile Tracing Application Wiqaytna. It will start by going through a description of the vulnerability, then a Proof of Concept will follow before concluding on a suggested remediation.

Commit

481661f

Delivery

23/11/2020

Recipient

Name

Title

Company

Mohamed ■■■■■

■■■■■

■■■■■

Youssef ■■■■■

■■■■■

■■■■■

Mohamed ■■■■■

■■■■■

■■■■■

Nasser ■■■■■

■■■■■

■■■■■

Zouheir ■■■■■

■■■■■

■■■■■

Changelog

Date

Version

Changes

20/06/2020

0.1

Analysis Started

11/07/2020

0.3

Anamnesis & Static Diagnostic Completed

17/07/2020

0.5

Urgent Security Advisory with PoC Issued

23/08/2020

0.7

Remediation Confirmed

23/11/2020

1.0

Anonymisation and public disclosure

PUBLIC

This document is, unless contraindicated, under CC BY-NC 3.0 licence

1. Description

A Major vulnerability has been discovered during the security assessment of Morocco’s COVID-19 Mobile Tracing Application Wiqaytna.

It concerns a core component of the application (Authentication) and can be classified under A2:2017-Broken Authentication in OWASP Top Ten or CWE-287: Improper Authentication in Common Weakness Enumeration.

A malicious actor can leverage this vulnerability of bypassing the second step of authentication (OTP to a phone number) to potentially impersonate and register to the platform as any given phone number.

Depending on the data treatment behind the scenes on the platform, the impact could range from poisoning the COVID-19 Tracing dataset to real-life consequences as creating an artificial cluster targeting a person of interest or a rival company.

The vulnerability has been scored using the CVSS v3.1 risk assessment framework and can be summarize as follow:

OverallScore
Figure 1. CVSS Vector
Vulnerability 1. OTP

A2:2017-Broken Authentication / CWE-287: Improper Authentication

8.6

Major Vulnerability scoring 8.6

Finding

OTP for phone number verification can be bypassed

Impact

Depending on the backend data treatment, impact could range from data poisoning to real-life consequences as creating an artificial cluster targeting a person of interest or a rival company.

Recos

It is recommended to improve the security of the Authentication process by enhancing the implemented Firebase Authentication method.

Action plan is medium and should be taken into consideration in a very short term

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Radar
Figure 2. Radar view

2. Proof Of Concept

2.1. Preparation

It should be noted that tests were conducted using the official Android version (1.1.0 at the time of writing) available on the Play Store, and does not require any particular pre-condition to exploit the vulnerability. The following tests were nevertheless conducted on a rooted phone for simplicity purposes.

Tests were also conducted on a non-rooted device (Android Emulator running a Production Android 9) and provided the same behavior.
Emulated
Figure 3. Testing on a Non-Rooted Android Emulator

Hardware-wise, a rooted phone (Xiaomi Redmi Note 6 Pro) running on Lineage OS with the latest Android version (Android 10) was used to demonstrate the following Proof of Concept.

  • Make sure that frida server is installed and running on the phone:

$ curl -O https://build.frida.re/frida/android/arm/bin/frida-server

$ adb push frida-server /data/local/tmp/

$ adb shell "chmod 755 /data/local/tmp/frida-server"

$ adb shell "/data/local/tmp/frida-server &"
  • Make also sure that objection is installed on the testing computer:

$ pip3 install objection

2.2. Attack Vector

Let’s break down the Proof of Concept video:

  • [00:03] Launching Application covid.trace.morocco using frida:

$ frida -U -f covid.trace.morocco --no-pause