Procter & Gamble Oral-B App 5.0.0 on Android AES inadequate encryption

Summaryinfo

A vulnerability has been found in Procter & Gamble Oral-B App 5.0.0 on Android and classified as problematic. This vulnerability affects unknown code of the component AES. This manipulation causes inadequate encryption. The identification of this vulnerability is CVE-2018-5298. The attack can only be executed locally. Furthermore, there is an exploit available. This vulnerability is considered historic because of its background and reception.

Detailsinfo

A vulnerability was found in Procter & Gamble Oral-B App 5.0.0 on Android (Android App Software). It has been declared as problematic. Affected by this vulnerability is an unknown part of the component AES. The manipulation with an unknown input leads to a inadequate encryption vulnerability. The CWE definition for the vulnerability is CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In the Procter & Gamble "Oral-B App" (aka com.pg.oralb.oralbapp) application 5.0.0 for Android, AES encryption with static parameters is used to secure the locally stored shared preferences. An attacker can gain access to locally stored user data more easily by leveraging access to the preferences XML file.

The bug was discovered 01/08/2018. The weakness was shared 01/08/2018 by Banana Joe as Auditing the Oral-B App as not defined advisory (Blog). It is possible to read the advisory at 1337sec.blogspot.de. The vendor was not involved in the public release. This vulnerability is known as CVE-2018-5298 since 01/08/2018. Attacking locally is a requirement. A single authentication is necessary for exploitation. Technical details are unknown but a public exploit is available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/29/2019). The attack technique deployed by this issue is T1600 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

Using the twitter secrets, it's possible to create bearer tokens impersonating the Oral-B twitter application. The secrets stored in the app are application tokens only - in my tests it was not possible to authenticate in user context.

A public exploit has been developed by Banana Joe and been published immediately after the advisory. It is possible to download the exploit at 1337sec.blogspot.de. It is declared as proof-of-concept. The advisory illustrates:

Please note no transmission of user specific brushing data has been identified. However, there is a cache that saves your last brushing sessions <:

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Additional details are provided at secnews24.com. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Android App Software

Vendor

• Procter & Gamble

Name

• Oral-B App

Version

• 5.0.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion