| शीर्षक | Tomofun Furbo 360, Furbo Mini Furbo 360 (≤ FB0035_FW_036), Furbo Mini (≤ MC0020_FW_074) Insecure Storage of Sensitve Information |
|---|
| विवरण | An attacker who retrieves the x-amz-grant-full-control ID from the collect_logs.sh file located on the Furbo device can use it to upload arbitrary data to the Furbo Device Debug Log S3 bucket. This may pollute the data source for Furbo, or result in a compromise of their systems or services if malware is uploaded and later executed. Additionally, as device IDs are issued sequentially, (see Android Finding 001), it is possible that an attacker could upload arbitrary files which would be associated with other Furbo user's devices.
Replication Steps:
Connect to the Furbo device or unsquash the Furbo service file.
If on device, navigate to /tmp/furbo_app/bin/ and run: cat collect_logs.sh
Observe that the a-amz-grant-full-control header is stored in the file. This header can be used to upload files to the S3 bucket as if you were a Furbo device. |
|---|
| उपयोगकर्ता | jTag Labs (UID 51246) |
|---|
| सबमिशन | 24/09/2025 04:05 PM (1 वर्ष पहले) |
|---|
| संयम | 11/10/2025 08:33 PM (17 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 328050 [Tomofun Furbo 360/Furbo Mini Debug Log S3 Bucket collect_logs.sh सूचना का प्रकटीकरण] |
|---|
| अंक | 0 |
|---|