CVE-2017-11132
HighSummary
An issue was discovered in heinekingmedia StashCat before version 1.5.18 for Android related to the lack of certificate pinning. As a result, an attacker could issue a certificate for the backend, and the application would not notice it.
Risk Assessment
The absence of certificate pinning exposes the application to man-in-the-middle attacks, potentially leading to user data interception and unauthorized access to the backend.
Recommendation
It is recommended to update the application to version 1.5.18 or later to implement proper certificate pinning security measures.
Other vulnerabilities in heinekingmedia StashCat
See all- CVE-2017-11133High
An issue exists in heinekingmedia StashCat regarding the generation of encryption keys for messages. The use of AES in CBC mode with a pseudo-random secret generated by math.random() does not provide adequate security.
- CVE-2017-11130High
An issue was discovered in heinekingmedia StashCat related to the lack of integrity and authenticity checks in the protocol. Affected versions are 1.7.5 for Android, 0.0.80w for Web, and 0.0.86 for Desktop.
- CVE-2017-11129Critical
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android related to key storage. The keystore is locked with a hard-coded password, allowing anyone with access to read its contents, including the user's private key.
Original NVD description (English source)
An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it.