PT-2020-20281 · Oklok · Oklok Mobile Companion App+1

Published

2020-05-04

·

Updated

2021-07-21

·

CVE-2020-8791

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions OKLOK mobile companion app version 3.1.1 Fingerprint Bluetooth Padlock FB50 version 2.3
Description The issue allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.
Recommendations For OKLOK mobile companion app version 3.1.1, consider disabling the use of authenticated tokens until a patch is available. For Fingerprint Bluetooth Padlock FB50 version 2.3, restrict access to the API endpoints to minimize the risk of exploitation. Avoid using the user ID variable in the affected API requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2020-8791

Affected Products

Fingerprint Bluetooth Padlock Fb50
Oklok Mobile Companion App