{"id":23782,"date":"2025-03-28T13:38:54","date_gmt":"2025-03-28T12:38:54","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=23782"},"modified":"2025-04-07T14:58:14","modified_gmt":"2025-04-07T12:58:14","slug":"usd-2025-0002","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0002\/","title":{"rendered":"usd-2025-0002"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n

usd-2025-0002 | Element Android 1.6.x - PIN request Bypass<\/h1>\n

<\/h1>\n

Product<\/strong>: Element Android
Affected Version<\/strong>: 1.6.x
Vulnerability Type<\/strong>: Broken Access (CWE-284)
Security Risk<\/strong>: Medium
Vendor<\/strong>: Element
Vendor URL<\/strong>: https:\/\/github.com\/element-hq\/element-android<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE number<\/strong>: CVE-2025-27606
CVE Link<\/strong>: https:\/\/www.cve.org\/CVERecord?id=CVE-2025-27606<\/a>
Advisory ID<\/strong>: usd-2025-0002<\/p>\n

Description<\/h3>\n

A brute force attack on the PIN code is possible if the PIN code is set and the internet connection is deactivated.
The session is not invalidated and the PIN can then be used to gain full access to the application. As the PIN code is a four-digit number, this attack can be carried out in a short time.<\/p>\n

The following code snippets are from the open source client Element Android<\/em>. The underlying vulnerability is located in MainActivity.kt<\/strong><\/a>.<\/p>\n

Proof of Concept<\/h3>\n

If the PIN code is entered incorrectly, the method onWrongPin()<\/strong> is called, which is located in the file vector\/src\/main\/java\/im\/vector\/app\/features\/pin\/PinFragment.kt<\/strong>:<\/p>\n

\n
<\/span>private<\/span> <\/span>fun<\/span> <\/span>onWrongPin<\/span>()<\/span> <\/span>{<\/span>\n    <\/span>val<\/span> <\/span>remainingAttempts<\/span> <\/span>=<\/span> <\/span>pinCodeStore<\/span>.<\/span>onWrongPin<\/span>()<\/span>\n    <\/span>when<\/span> <\/span>{<\/span>\n        <\/span>remainingAttempts<\/span> <\/span>><\/span> <\/span>1<\/span> <\/span>-><\/span>\n            <\/span>requireActivity<\/span>().<\/span>toast<\/span>(<\/span>resources<\/span>.<\/span>getQuantityString<\/span>(<\/span>CommonPlurals<\/span>.<\/span>wrong_pin_message_remaining_attempts<\/span>,<\/span> <\/span>remainingAttempts<\/span>,<\/span> <\/span>remainingAttempts<\/span>))<\/span>\n        <\/span>remainingAttempts<\/span> <\/span>==<\/span> <\/span>1<\/span> <\/span>-><\/span>\n            <\/span>requireActivity<\/span>().<\/span>toast<\/span>(<\/span>CommonStrings<\/span>.<\/span>wrong_pin_message_last_remaining_attempt<\/span>)<\/span>\n        <\/span>else<\/span> <\/span>-><\/span> <\/span>{<\/span>\n            <\/span>requireActivity<\/span>().<\/span>toast<\/span>(<\/span>CommonStrings<\/span>.<\/span>too_many_pin_failures<\/span>)<\/span>\n            <\/span>\/\/ Logout<\/span>\n            <\/span>launchResetPinFlow<\/span>()<\/span>\n<\/span>        <\/span>}<\/span>\n    <\/span>}<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
This checks the number of remaining input attempts and calls the launchResetPinFlow()<\/strong> function if an incorrect PIN has been entered too often:<\/p>\n
\n
<\/span>  <\/span>private<\/span> <\/span>fun<\/span> <\/span>launchResetPinFlow<\/span>()<\/span> <\/span>{<\/span>\n      <\/span>MainActivity<\/span>.<\/span>restartApp<\/span>(<\/span>requireActivity<\/span>(),<\/span> <\/span>MainActivityArgs<\/span>(<\/span>clearCredentials<\/span> <\/span>=<\/span> <\/span>true<\/span>))<\/span>\n<\/span>  <\/span>}<\/span>\n<\/pre>\n<\/div>\n
The restartApp()<\/strong> method starts a new activity with the argument clearCredentials = true<\/strong>:<\/p>\n
\n
<\/span>fun<\/span> <\/span>restartApp<\/span>(<\/span>activity<\/span>:<\/span> <\/span>Activity<\/span>,<\/span> <\/span>args<\/span>:<\/span> <\/span>MainActivityArgs<\/span>)<\/span> <\/span>{<\/span>\n    <\/span>val<\/span> <\/span>intent<\/span> <\/span>=<\/span> <\/span>Intent<\/span>(<\/span>activity<\/span>,<\/span> <\/span>MainActivity<\/span>::<\/span>class<\/span>.<\/span>java<\/span>)<\/span>\n    <\/span>intent<\/span>.<\/span>addFlags<\/span>(<\/span>Intent<\/span>.<\/span>FLAG_ACTIVITY_NEW_TASK<\/span> <\/span>or<\/span> <\/span>Intent<\/span>.<\/span>FLAG_ACTIVITY_CLEAR_TASK<\/span>)<\/span>\n\n    <\/span>intent<\/span>.<\/span>putExtra<\/span>(<\/span>EXTRA_ARGS<\/span>,<\/span> <\/span>args<\/span>)<\/span>\n    <\/span>activity<\/span>.<\/span>startActivity<\/span>(<\/span>intent<\/span>)<\/span>\n<\/span>}<\/span>\n<\/pre>\n<\/div>\n
This and all subsequent methods originate from the file vector\/src\/main\/java\/im\/vector\/app\/features\/MainActivity.kt<\/strong>.<\/p>\n
During the restart, the function handleAppStarted()<\/strong> is called, which defines how the clearCredentials<\/strong> argument is handled. By passing clearCredentials = true<\/strong>, the two methods clearNotifications()<\/strong> and doCleanup()<\/strong> are called:<\/p>\n
\n
<\/span>    <\/span>[<\/span>...<\/span>]<\/span>\n    <\/span>args<\/span> <\/span>=<\/span> <\/span>parseArgs<\/span>()<\/span>\n    <\/span>if<\/span> <\/span>(<\/span>args<\/span>.<\/span>clearCredentials<\/span> <\/span>||<\/span> <\/span>args<\/span>.<\/span>isUserLoggedOut<\/span> <\/span>||<\/span> <\/span>args<\/span>.<\/span>clearCache<\/span>)<\/span> <\/span>{<\/span>\n        <\/span>clearNotifications<\/span>()<\/span>\n<\/span>    <\/span>}<\/span>\n    <\/span>\/\/ Handle some wanted cleanup<\/span>\n    <\/span>if<\/span> <\/span>(<\/span>args<\/span>.<\/span>clearCache<\/span> <\/span>||<\/span> <\/span>args<\/span>.<\/span>clearCredentials<\/span>)<\/span> <\/span>{<\/span>\n<\/span>        <\/span>doCleanUp<\/span>()<\/span>\n    <\/span>}<\/span> <\/span>else<\/span> <\/span>{<\/span>\n    <\/span>[<\/span>...<\/span>]<\/span>\n<\/pre>\n<\/div>\n
The latter passes the argument ignoreServerError = false<\/strong> to the method signout()<\/strong>:<\/p>\n
\n
<\/span>private<\/span> <\/span>fun<\/span> <\/span>doCleanUp<\/span>()<\/span> <\/span>{<\/span>\n    <\/span>val<\/span> <\/span>session<\/span> <\/span>=<\/span> <\/span>activeSessionHolder<\/span>.<\/span>getSafeActiveSession<\/span>()<\/span>\n    <\/span>if<\/span> <\/span>(<\/span>session<\/span> <\/span>==<\/span> <\/span>null<\/span>)<\/span> <\/span>{<\/span>\n        <\/span>startNextActivityAndFinish<\/span>()<\/span>\n        <\/span>return<\/span>\n    <\/span>}<\/span>\n\n    <\/span>val<\/span> <\/span>onboardingStore<\/span> <\/span>=<\/span> <\/span>session<\/span>.<\/span>vectorStore<\/span>(<\/span>this<\/span>)<\/span>\n    <\/span>when<\/span> <\/span>{<\/span>\n        <\/span>args<\/span>.<\/span>isAccountDeactivated<\/span> <\/span>-><\/span> <\/span>{<\/span>\n            <\/span>lifecycleScope<\/span>.<\/span>launch<\/span> <\/span>{<\/span>\n                <\/span>\/\/ Just do the local cleanup<\/span>\n                <\/span>Timber<\/span>.<\/span>w<\/span>(<\/span>\"Account deactivated, start app\"<\/span>)<\/span>\n                <\/span>activeSessionHolder<\/span>.<\/span>clearActiveSession<\/span>()<\/span>\n                <\/span>doLocalCleanup<\/span>(<\/span>clearPreferences<\/span> <\/span>=<\/span> <\/span>true<\/span>,<\/span> <\/span>onboardingStore<\/span>)<\/span>\n                <\/span>startNextActivityAndFinish<\/span>()<\/span>\n            <\/span>}<\/span>\n        <\/span>}<\/span>\n\n        <\/span>args<\/span>.<\/span>clearCredentials<\/span> <\/span>-><\/span> <\/span>{<\/span>\n<\/span>            <\/span>signout<\/span>(<\/span>session<\/span>,<\/span> <\/span>onboardingStore<\/span>,<\/span> <\/span>ignoreServerError<\/span> <\/span>=<\/span> <\/span>false<\/span>)<\/span>\n        <\/span>}<\/span>\n        <\/span>args<\/span>.<\/span>clearCache<\/span> <\/span>-><\/span> <\/span>{<\/span>\n            <\/span>lifecycleScope<\/span>.<\/span>launch<\/span> <\/span>{<\/span>\n                <\/span>session<\/span>.<\/span>clearCache<\/span>()<\/span>\n                <\/span>doLocalCleanup<\/span>(<\/span>clearPreferences<\/span> <\/span>=<\/span> <\/span>false<\/span>,<\/span> <\/span>onboardingStore<\/span>)<\/span>\n                <\/span>session<\/span>.<\/span>startSyncing<\/span>(<\/span>applicationContext<\/span>)<\/span>\n                <\/span>startNextActivityAndFinish<\/span>()<\/span>\n            <\/span>}<\/span>\n        <\/span>}<\/span>\n    <\/span>}<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
This method handles the actual signout process:<\/p>\n
\n
<\/span>private<\/span> fun<\/span> signout<\/span>(<\/span>\n      session<\/span>:<\/span> Session<\/span>,<\/span>\n      onboardingStore<\/span>:<\/span> VectorSessionStore<\/span>,<\/span>\n      ignoreServerError<\/span>:<\/span> Boolean<\/span>,<\/span>\n)<\/span> {<\/span>\n  lifecycleScope<\/span>.<\/span>launch<\/span> {<\/span>\n      try<\/span> {<\/span>\n          session<\/span>.<\/span>signOutService<\/span>().<\/span>signOut<\/span>(<\/span>!<\/span>args<\/span>.<\/span>isUserLoggedOut<\/span>,<\/span> ignoreServerError<\/span>)<\/span>\n<\/span>      }<\/span> catch<\/span> (<\/span>failure<\/span>:<\/span> Throwable<\/span>)<\/span> {<\/span>\n          Timber<\/span>.<\/span>e<\/span>(<\/span>failure<\/span>,<\/span> \"SIGN_OUT: error, propose to sign out anyway\"<\/span>)<\/span>\n          displaySignOutFailedDialog<\/span>(<\/span>session<\/span>,<\/span> onboardingStore<\/span>)<\/span>\n<\/span>          return<\/span>@<\/span>launch<\/span>\n      }<\/span>\n      Timber<\/span>.<\/span>w<\/span>(<\/span>\"SIGN_OUT: success, start app\"<\/span>)<\/span>\n      activeSessionHolder<\/span>.<\/span>clearActiveSession<\/span>()<\/span>\n      doLocalCleanup<\/span>(<\/span>clearPreferences<\/span> =<\/span> true<\/span>,<\/span> onboardingStore<\/span>)<\/span>\n      startNextActivityAndFinish<\/span>()<\/span>\n  }<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
If an error occurs, the displaySignOutFailedDialog<\/strong> is displayed, which offers the three buttons sign_out_anyway<\/strong> (Sign out anyway<\/em>), global_retry<\/strong> (Retry<\/em>) and action_cancel<\/strong> (Cancel<\/em>):<\/p>\n
\n
<\/span>private<\/span> <\/span>fun<\/span> <\/span>displaySignOutFailedDialog<\/span>(<\/span>\n      <\/span>session<\/span>:<\/span> <\/span>Session<\/span>,<\/span>\n      <\/span>onboardingStore<\/span>:<\/span> <\/span>VectorSessionStore<\/span>,<\/span>\n)<\/span> <\/span>{<\/span>\n  <\/span>if<\/span> <\/span>(<\/span>lifecycle<\/span>.<\/span>currentState<\/span>.<\/span>isAtLeast<\/span>(<\/span>Lifecycle<\/span>.<\/span>State<\/span>.<\/span>RESUMED<\/span>))<\/span> <\/span>{<\/span>\n      <\/span>MaterialAlertDialogBuilder<\/span>(<\/span>this<\/span>)<\/span>\n              <\/span>.<\/span>setTitle<\/span>(<\/span>CommonStrings<\/span>.<\/span>dialog_title_error<\/span>)<\/span>\n              <\/span>.<\/span>setMessage<\/span>(<\/span>CommonStrings<\/span>.<\/span>sign_out_failed_dialog_message<\/span>)<\/span>\n              <\/span>.<\/span>setPositiveButton<\/span>(<\/span>CommonStrings<\/span>.<\/span>sign_out_anyway<\/span>)<\/span> <\/span>{<\/span> <\/span>_<\/span>,<\/span> <\/span>_<\/span> <\/span>-><\/span>\n                  <\/span>signout<\/span>(<\/span>session<\/span>,<\/span> <\/span>onboardingStore<\/span>,<\/span> <\/span>ignoreServerError<\/span> <\/span>=<\/span> <\/span>true<\/span>)<\/span>\n<\/span>              <\/span>}<\/span>\n              <\/span>.<\/span>setNeutralButton<\/span>(<\/span>CommonStrings<\/span>.<\/span>global_retry<\/span>)<\/span> <\/span>{<\/span> <\/span>_<\/span>,<\/span> <\/span>_<\/span> <\/span>-><\/span>\n                  <\/span>signout<\/span>(<\/span>session<\/span>,<\/span> <\/span>onboardingStore<\/span>,<\/span> <\/span>ignoreServerError<\/span> <\/span>=<\/span> <\/span>false<\/span>)<\/span>\n<\/span>              <\/span>}<\/span>\n              <\/span>.<\/span>setNegativeButton<\/span>(<\/span>CommonStrings<\/span>.<\/span>action_cancel<\/span>)<\/span> <\/span>{<\/span> <\/span>_<\/span>,<\/span> <\/span>_<\/span> <\/span>-><\/span> <\/span>startNextActivityAndFinish<\/span>(<\/span>ignoreClearCredentials<\/span> <\/span>=<\/span> <\/span>true<\/span>)<\/span> <\/span>}<\/span>\n<\/span>              <\/span>.<\/span>setCancelable<\/span>(<\/span>false<\/span>)<\/span>\n              <\/span>.<\/span>show<\/span>()<\/span>\n  <\/span>}<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
If Cancel<\/em> is selected, startNextActivityAndFinish<\/strong> is called with the parameter ignoreClearCredentials = true<\/strong>. As the active session has not yet been deleted, it is retrieved and the HomeActivity<\/strong> is then opened:<\/p>\n
\n
<\/span>private<\/span> <\/span>fun<\/span> <\/span>startNextActivityAndFinish<\/span>(<\/span>ignoreClearCredentials<\/span>:<\/span> <\/span>Boolean<\/span> <\/span>=<\/span> <\/span>false<\/span>)<\/span> <\/span>{<\/span>\n  <\/span>val<\/span> <\/span>intent<\/span> <\/span>=<\/span> <\/span>when<\/span> <\/span>{<\/span>\n      <\/span>args<\/span>.<\/span>clearCredentials<\/span> <\/span>&&<\/span>\n            <\/span>!<\/span>ignoreClearCredentials<\/span> <\/span>&&<\/span>\n            <\/span>(<\/span>!<\/span>args<\/span>.<\/span>isUserLoggedOut<\/span> <\/span>||<\/span> <\/span>args<\/span>.<\/span>isAccountDeactivated<\/span>)<\/span> <\/span>-><\/span> <\/span>{<\/span>\n          <\/span>\/\/ User has explicitly asked to log out or deactivated his account<\/span>\n          <\/span>navigator<\/span>.<\/span>openLogin<\/span>(<\/span>this<\/span>,<\/span> <\/span>null<\/span>)<\/span>\n          <\/span>null<\/span>\n      <\/span>}<\/span>\n      <\/span>args<\/span>.<\/span>isSoftLogout<\/span> <\/span>-><\/span> <\/span>{<\/span>\n          <\/span>\/\/ The homeserver has invalidated the token, with a soft logout<\/span>\n          <\/span>navigator<\/span>.<\/span>softLogout<\/span>(<\/span>this<\/span>)<\/span>\n          <\/span>null<\/span>\n      <\/span>}<\/span>\n      <\/span>args<\/span>.<\/span>isUserLoggedOut<\/span> <\/span>-><\/span>\n          <\/span>\/\/ the homeserver has invalidated the token (password changed, device deleted, other security reasons)<\/span>\n          <\/span>SignedOutActivity<\/span>.<\/span>newIntent<\/span>(<\/span>this<\/span>)<\/span>\n      <\/span>activeSessionHolder<\/span>.<\/span>hasActiveSession<\/span>()<\/span> <\/span>-><\/span>\n<\/span>          <\/span>\/\/ We have a session.<\/span>\n          <\/span>\/\/ Check it can be opened<\/span>\n          <\/span>if<\/span> <\/span>(<\/span>activeSessionHolder<\/span>.<\/span>getActiveSession<\/span>().<\/span>isOpenable<\/span>)<\/span> <\/span>{<\/span>\n<\/span>              <\/span>HomeActivity<\/span>.<\/span>newIntent<\/span>(<\/span>this<\/span>,<\/span> <\/span>firstStartMainActivity<\/span> <\/span>=<\/span> <\/span>false<\/span>,<\/span> <\/span>existingSession<\/span> <\/span>=<\/span> <\/span>true<\/span>)<\/span>\n<\/span>          <\/span>}<\/span> <\/span>else<\/span> <\/span>{<\/span>\n              <\/span>\/\/ The token is still invalid<\/span>\n              <\/span>navigator<\/span>.<\/span>softLogout<\/span>(<\/span>this<\/span>)<\/span>\n              <\/span>null<\/span>\n          <\/span>}<\/span>\n      <\/span>else<\/span> <\/span>-><\/span> <\/span>{<\/span>\n          <\/span>\/\/ First start, or no active session<\/span>\n          <\/span>navigator<\/span>.<\/span>openLogin<\/span>(<\/span>this<\/span>,<\/span> <\/span>null<\/span>)<\/span>\n          <\/span>null<\/span>\n      <\/span>}<\/span>\n  <\/span>}<\/span>\n  <\/span>startIntentAndFinish<\/span>(<\/span>intent<\/span>)<\/span>\n}<\/span>\n<\/pre>\n<\/div>\n
The app then asks for the PIN code again and allows the next attempts to be entered. This allows the PIN code to be brute-forced when the internet connection is disconnected.<\/p>\n
The session data is not deleted when the signout function returns. This happens because of the error in the catch block at line 319. As a result, the PIN can be used after a brute force attack to unlock the app when the internet connection is reactivated. This allows the user to continue using the still-active session and gain full access to all content.
The session data would be deleted in the doLocalCleanup<\/strong> function, which is called in line 323 of the signout<\/strong> method. However, this code point is not reached if the logout fails.<\/p>\n
Fix<\/h3>\n
It is recommended to set the parameter ignoreServerError<\/strong>, which is used to call the signout<\/strong> function in line 295, to true<\/strong>. This may impair the user-friendliness, but represents a short-term and easy-to-implement solution for the described vulnerability.<\/p>\n
References<\/h3>\n