PT-2018-14014 · Phonepe · Phonepe

CVE-2018-17401 · Publicado 2018-09-23 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PhonePe wallet (aka com.PhonePe.app) versions 3.0.6 through 3.3.26

Description The issue allows attackers to perform Account Takeover attacks by exploiting the Forgot Password feature. To exploit this, the user has to explicitly install a malicious app and provide accessibility permission to the malicious app. The Android platform provides fair warnings to the users before turning on accessibility for any application. This is similar to installing malicious keyboards or malicious apps taking screenshots.

Recommendations For versions 3.0.6 through 3.3.26, consider disabling the Forgot Password feature until a patch is available. Restrict access to the accessibility permission to minimize the risk of exploitation. Avoid installing malicious apps and do not provide accessibility permission to untrusted applications.

Exploit

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2018-17401

Produtos afetados

Phonepe

Referências · 4

• 🔥 https://github.com/magicj3lly/appexploits/blob/master/PhonePe%20Authentication%20Bypass-2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17401 · Nota de Segurança
• https://t.me/cvenotify/89179 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-17401 · Aviso do Fabricante