CVE-2017-11129
CriticalSummary
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android related to key storage. The keystore is locked with a hard-coded password, allowing anyone with access to read its contents, including the user's private key.
Risk Assessment
Access to private keys can lead to serious security breaches, including identity theft and unauthorized access to data.
Recommendation
It is recommended to remove the hard-coded password and implement more secure key management practices to limit access to sensitive data.
Other vulnerabilities in heinekingmedia StashCat
See all- CVE-2017-11133High
An issue exists in heinekingmedia StashCat regarding the generation of encryption keys for messages. The use of AES in CBC mode with a pseudo-random secret generated by math.random() does not provide adequate security.
- CVE-2017-11132High
An issue was discovered in heinekingmedia StashCat before version 1.5.18 for Android related to the lack of certificate pinning. As a result, an attacker could issue a certificate for the backend, and the application would not notice it.
- CVE-2017-11130High
An issue was discovered in heinekingmedia StashCat related to the lack of integrity and authenticity checks in the protocol. Affected versions are 1.7.5 for Android, 0.0.80w for Web, and 0.0.86 for Desktop.
Original NVD description (English source)
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with access to the keystore can read the content out, for example the private key of the user.