PT-2019-13726 · Uidai · Maadhaar

Published 2019-08-13 · Updated 2019-08-19 · CVE-2019-14516

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions mAadhaar application version 1.2.7

Description The issue concerns a lack of SSL Certificate Validation in the mAadhaar application, making it susceptible to man-in-the-middle attacks. Specifically, this affects requests for FAQs or Help, potentially compromising the security of user interactions.

Recommendations For mAadhaar application version 1.2.7, consider disabling the use of FAQs or Help features until a patch is available that implements proper SSL Certificate Validation to prevent man-in-the-middle attacks.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2019-14516

Affected Products

Maadhaar

References · 6

• 🔥 https://github.com/fs0c131y/ConPresentations/blob/master/AppSecVillageDefcon27.mAadhaar.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14516 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14516 · Vendor Advisory
• https://play.google.com/store/apps/details?id=in.gov.uidai.mAadhaarPlus&hl=en_US · Vendor Advisory
• https://github.com/fs0c131y/ConPresentations · Note
• https://t.me/yah_channel/206 · Telegram Post