Citrix GoToMeeting 5.0.799.1238 on Android HTTP Request Logger com.citrixonline.android.gotomeeting-1.apk information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Citrix GoToMeeting 5.0.799.1238 on Android. Impacted is an unknown function of the file com.citrixonline.android.gotomeeting-1.apk of the component HTTP Request Logger. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2014-1664. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Citrix GoToMeeting 5.0.799.1238 on Android (Connectivity Software) and classified as problematic. This issue affects an unknown functionality of the file com.citrixonline.android.gotomeeting-1.apk of the component HTTP Request Logger. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The Citrix GoToMeeting application 5.0.799.1238 for Android logs HTTP requests containing sensitive information, which allows attackers to obtain user IDs, meeting details, and authentication tokens via an application that reads the system log file.

The bug was discovered 01/20/2014. The weakness was presented 01/24/2014 by Claudio J. Lacay as GoToMeeting Information Disclosure via Logging Output (Android) as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The vendor was not involved in the public release. The identification of this vulnerability is CVE-2014-1664 since 01/23/2014. Attacking locally is a requirement. The successful exploitation needs a simple authentication. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK. The advisory points out:

The latest release of the software is vulnerable to information disclosure via logging output, resulting in the leak of userID, meeting details, and authentication tokens. Android applications with permissions to read system log files may obtain the leaked information.

After immediately, there has been an exploit disclosed. The exploit is available at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (90695), Exploit-DB (39061), SecurityFocus (BID 65123†) and OSVDB (102559†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Connectivity Software

Vendor

• Citrix

Name

• GoToMeeting

Version

• 5.0.799.1238

License

• commercial

Website

• Vendor: https://www.citrix.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion