CVE-2017-11130
HighSummary
An issue was discovered in heinekingmedia StashCat related to the lack of integrity and authenticity checks in the protocol. Affected versions are 1.7.5 for Android, 0.0.80w for Web, and 0.0.86 for Desktop.
Risk Assessment
The lack of proper security measures may allow attackers to conduct man-in-the-middle attacks and replay attacks, posing a serious threat to data confidentiality.
Recommendation
It is recommended to update to the latest version that introduces appropriate integrity and authenticity verification mechanisms.
Other vulnerabilities in heinekingmedia StashCat
See all- CVE-2017-11133High
An issue exists in heinekingmedia StashCat regarding the generation of encryption keys for messages. The use of AES in CBC mode with a pseudo-random secret generated by math.random() does not provide adequate security.
- CVE-2017-11132High
An issue was discovered in heinekingmedia StashCat before version 1.5.18 for Android related to the lack of certificate pinning. As a result, an attacker could issue a certificate for the backend, and the application would not notice it.
- CVE-2017-11129Critical
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android related to key storage. The keystore is locked with a hard-coded password, allowing anyone with access to read its contents, including the user's private key.
Original NVD description (English source)
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackers can conduct replay attacks.