This urgent security advisory is about to describe a Major vulnerability discovered during the security assessment of Morocco’s COVID-19 Mobile Tracing Application Wiqaytna. It will start by going through a description of the vulnerability, then a Proof of Concept will follow before concluding on a suggested remediation.
Commit |
|
||||||||||||||||||
Delivery |
23/11/2020 |
||||||||||||||||||
Recipient |
|
||||||||||||||||||
Changelog |
|
||||||||||||||||||
PUBLIC |
|||||||||||||||||||
This document is, unless contraindicated, under CC BY-NC 3.0 licence |
1. Description
A Major vulnerability has been discovered during the security assessment of Morocco’s COVID-19 Mobile Tracing Application Wiqaytna.
It concerns a core component of the application (Authentication) and can be classified under A2:2017-Broken Authentication in OWASP Top Ten or CWE-287: Improper Authentication in Common Weakness Enumeration.
A malicious actor can leverage this vulnerability of bypassing the second step of authentication (OTP to a phone number) to potentially impersonate and register to the platform as any given phone number.
Depending on the data treatment behind the scenes on the platform, the impact could range from poisoning the COVID-19 Tracing dataset to real-life consequences as creating an artificial cluster targeting a person of interest or a rival company.
The vulnerability has been scored using the CVSS v3.1 risk assessment framework and can be summarize as follow:
A2:2017-Broken Authentication / CWE-287: Improper Authentication |
|
|
Major Vulnerability scoring 8.6 |
||
Finding |
OTP for phone number verification can be bypassed |
|
Impact |
Depending on the backend data treatment, impact could range from data poisoning to real-life consequences as creating an artificial cluster targeting a person of interest or a rival company. |
|
Recos |
It is recommended to improve the security of the Authentication process by enhancing the implemented Firebase Authentication method. |
|
Action plan is medium and should be taken into consideration in a very short term |
||
|
||
2. Proof Of Concept
2.1. Preparation
It should be noted that tests were conducted using the official Android version (1.1.0 at the time of writing) available on the Play Store, and does not require any particular pre-condition to exploit the vulnerability. The following tests were nevertheless conducted on a rooted phone for simplicity purposes.
| Tests were also conducted on a non-rooted device (Android Emulator running a Production Android 9) and provided the same behavior. |
Hardware-wise, a rooted phone (Xiaomi Redmi Note 6 Pro) running on Lineage OS with the latest Android version (Android 10) was used to demonstrate the following Proof of Concept.
-
Make sure that frida server is installed and running on the phone:
$ curl -O https://build.frida.re/frida/android/arm/bin/frida-server $ adb push frida-server /data/local/tmp/ $ adb shell "chmod 755 /data/local/tmp/frida-server" $ adb shell "/data/local/tmp/frida-server &"
-
Make also sure that objection is installed on the testing computer:
$ pip3 install objection
2.2. Attack Vector
Let’s break down the Proof of Concept video:
-
[00:03] Launching Application covid.trace.morocco using frida:
$ frida -U -f covid.trace.morocco --no-pause