Heag Mobilo Insecure Database Replication
- Vendor: GeoMobile GmbH
- Product: HEAG mobilo
- Affected Version: 2.4.45
- Severity: Low
- Short summary:
The app synchronizes data with a remote CouchDB server without proper server authentication. This allows man-in-the-middle attackers to manipulate the data shown in the app.
The app connects to http://couchdata.busaccess.de:5984/ using a plain HTTP connection. Since this connection is neither authenticated, nor integrity-protected, a man-in-the-middle attacker on the same network can easily inject rogue data. A simple DNS manipulation is sufficient to spoof a rogue database server and supply attacker-defined records
The app apparently uses the publicly-visible CouchDB for updating its own data via database replication. An attacker can inject new records, or modify and delete existing ones during this replication due to the missing transport security.
Disable the replication between the local database and CouchDB.
Always use TLS when communicating with remote services. Using a properly validated TLS connection ensures that the authenticity of the remote server and the integrity of the downloaded data.
- 2016-11-29: Vulnerability Discovered
- 2016-12-12: Reported
- 2017-02-16: Fixed