CVE-2022-36539 PoC — Eigen&Wijzer Ouderapp 安全漏洞

Source

Associated Vulnerability

Description

Insecure Permissions WeDayCare

Readme

# CVE-2022-36539
Insecure Direct Object Reference (IDOR) WeDayCare B.V.

WeDayCare B.V Ouderapp before v1.1.22 allows attackers to alter the ID value within intercepted calls to gain access to data of other parents and children.

Traffic with the API is made transparent via a proxy such as Burp Suite. Although it cannot be accessed without authentication, no authorization appears to be applied. This way I can not only request the data of my own children, but also that of other children. This gives me full visibility into the personal data of all families, with everything processed in the app as defined in the GDPR. For this I only have to change the ID to that of another child, parent, chat, or the like.

GET request

![image](https://user-images.githubusercontent.com/4934752/188823899-a9cb472d-37c9-468c-9765-2d16d90a7c8a.png)

Reponse for the previous request

![image](https://user-images.githubusercontent.com/4934752/188824277-a593243e-e6ae-41eb-9a2d-85de75f4bb4a.png)

If I change ID 3586 to, for example, 3576

![image](https://user-images.githubusercontent.com/4934752/188824647-b3ffaab8-5007-499a-93ff-7750b601a546.png)

Can I see the data of someone else's son or daughter

![image](https://user-images.githubusercontent.com/4934752/188824898-97f94a4d-8566-43fc-bcbc-3adf887c1f14.png)

Due lack of implementation of rate-limiting it's also possible to brute force valid ID's.

This also works with the chat, child details and other functionalities.

## Advisory
The developer has fixed the lack of authorisation within the webapplication. Mobile users are required to update to the newest version of the mobile app.

File Snapshot

 [4.0K]  /data/pocs/e036dc7b463b8c4700e56ad27b89fa67107a6ca0
└── [1.6K]  README.md

0 directories, 1 file

Remarks