| Título | Dragon Brothers Smart Fingerprint Lock OKLOK APP 4.3.0 has an override vulnerability |
|---|
| Descripción | Dragon Brothers Smart Fingerprint Lock OKLOKAPP 4.3.0 has an override vulnerability
A vulnerability classified as critical has been discovered in Dragon Brothers Smart Fingerprint Lock. This can lead to a serious personal information vulnerability that allows arbitrary viewing of another person's password lock account, password, personal location and other private information.
https://github.com/wswokao/locktesting/blob/main/README.md
# Smart Bluetooth fingerprint lock override access vulnerability
## 0x01 Vulnerability ProcessOverview
Long Brothers Bluetooth fingerprint lock has an override loophole
# 0x02 Vulnerability Discovery
We test for vulnerabilities in its functional points
Let's start with the registration function of the user interface:
### Registration function module
1、Captcha logic vulnerability:
(1)According to the normal registration logic, enter the mailbox, get the verification code to view the mailbox, you can see that the verification code is composed of 4 digits.
(2)After entering the verification code and clicking register, check the normal return package and find that the content of the return package is the password we need。
(3)We return to the registration page, enter the email, get the verification code randomly enter an incorrect verification code and click the registration function.
(4)Check the return packet data, directly modify the status 2001 to 2000
(5)Prompts for successful registration.
Binding device module
Login to find the need to bind the Bluetooth fingerprint lock device, (Bluetooth, number, QR code)
(1) Using Bluetooth to add is based on the device mac address
(2)We add devices using a QR code/number that uniquely identifies the device
(3)If the lock is already bound, it prompts that authorization needs to be obtained from the binder.
(5)Authorization requires an SMS to be sent to the person to whom the device is tied
VC binding vulnerability
(6)We go back to the previous step where authorization is required and add the device directly using the burp directly with the number which is available to traverse the device information directly
Return device information with user phone number, device number, password of device lock, mac address of device
User account information leaked
The packet before binding the device can traverse the user information by the plaintext id value - such as the user's login name, md5 password, user's gender, etc.The packet before binding the device can traverse the user information by the plaintext id value - such as the user's login name, md5 password, user's gender, etc.
|
|---|
| Fuente | ⚠️ https://github.com/wswokao/locktesting/blob/main/README.md |
|---|
| Usuario | Nikki2023 (UID 45692) |
|---|
| Sumisión | 2023-04-26 05:01 (hace 3 años) |
|---|
| Moderación | 2023-04-26 07:30 (2 hours later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 154738 [OKLOK Mobile Companion App 3.1.1 divulgación de información] |
|---|
| Puntos | 0 |
|---|