{"id":16569,"date":"2021-07-08T10:32:08","date_gmt":"2021-07-08T08:32:08","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2018-0024\/"},"modified":"2021-07-19T14:08:57","modified_gmt":"2021-07-19T12:08:57","slug":"usd-2018-0024","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2018-0024\/","title":{"rendered":"usd-2018-0024"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\" custom_padding=\"||0px|||\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\" custom_margin=\"||23px||false|false\"]<\/p>\n

usd-2018-0024 | Shpock App for Android & Iphone\/current<\/span><\/h1>\n

<\/span>
Advisory ID<\/strong>: usd-2018-0024<\/span>
CVE Number<\/strong>: N\/A<\/span>
Affected Product<\/strong>: Shpock App<\/span>
Affected Version<\/strong>: unknown<\/span>
Vulnerability Type<\/strong>: Username Enumeration<\/span>
Security Risk<\/strong>: Low<\/span>
Vendor URL<\/strong>: <\/span>https:\/\/www.shpock.com\/<\/a>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n

<\/h3>\n

Introduction<\/h3>\n

Because the app shows different error messages for existing and non-existing accounts, an attacker can test whether an account exists for a given email address.<\/p>\n

If you type an incorrect Email-Address and Password into the shpock-mobile-app login form, it responds with the message:<\/p>\n

\u201eDie eingegebene Email-Adresse ist mit keinem Account verbunden\u201c<\/p>\n

If you use a registered email-address a window pops up which says:<\/p>\n

\u201eHinweis!
Das Passwort und die E-mail-Adresse, die du eingegeben hast, stimmen nicht \u00fcberein.
Wenn du dich an dein Passwort nicht erinnern kannst, tippe auf den \u201ePasswort vergessen?\u201c-Button.\u201c<\/p>\n

An attacker can write a script that, for instance, tries all emails from a list of leaked email addresses. This gives him information about which addresses are registered with the service.
Based on this, he could selectively attack individual registered accounts.<\/p>\n

<\/span><\/p>\n

Proof of Concept\u00a0<\/h3>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\" column_structure=\"1_2,1_2\" custom_padding=\"0px||1px|||\"][et_pb_column _builder_version=\"4.9.4\" _module_preset=\"default\" type=\"1_2\"][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/Screenshot_20180907-145527_Shpock.jpg\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"Screenshot_20180907-145527_Shpock\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][\/et_pb_column][et_pb_column _builder_version=\"4.9.4\" _module_preset=\"default\" type=\"1_2\"][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/Screenshot_20180910-120705_Shpock.jpg\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"Screenshot_20180910-120705_Shpock\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column _builder_version=\"4.9.4\" _module_preset=\"default\" type=\"4_4\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n

\n
\n

Fix<\/h3>\n

If a user enters incorrect credentials, generally reply with something like this:<\/p>\n

\u201eIncorrect Username ** or ** Password\u201c<\/p>\n

<\/h3>\n

Timeline<\/h3>\n
    \n
  • 2018-09-10 Created advisory<\/li>\n
  • 2018-09-10 notified info@shpock.com<\/li>\n
  • 2018-10-08 notified info@finderly.com<\/li>\n
  • 2018-10-15 initiated transfer<\/li>\n
  • 2018-10-22 Vendor fixed the issue<\/li>\n
  • 2018-12-07 Security advisory released<\/li>\n<\/ul>\n

    <\/h3>\n

    Credits<\/h3>\n

    This security vulnerability was found by Yannick Westphal of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    usd-2018-0024 | Shpock App for Android & Iphone\/current Advisory ID: usd-2018-0024CVE Number: N\/AAffected Product: Shpock AppAffected Version: unknownVulnerability Type: Username EnumerationSecurity Risk: LowVendor URL: https:\/\/www.shpock.com\/Vendor Status: Fixed Introduction Because the app shows different error messages for existing and non-existing accounts, an attacker can test whether an account exists for a given email address. If you […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16569","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16569","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16569"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16569\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16569"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}