martinfrancois/cve-2021-36460Advisory detailing a pass-the-hash vulnerability in VeryFitPro app (<=3.3.7) where SHA-1 password hashes are used for authentication, enabling account takeover without the original password.
NVD CVE-2021-36460: https://nvd.nist.gov/vuln/detail/CVE-2021-36460
MITRE CVE-2021-36460: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-36460
The VeryFitPro app (Android: com.veryfit2hr.second, iOS) <=3.3.7 hashes the account's password locally on the device using SHA-1 and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords.
This allows an attacker in possession of a hash to takeover a user's account without knowing the original password, rendering the security benefits of storing hashed passwords in the database useless. This is also known as a Pass the Hash attack.
As of the 22nd of April 2022, both Android and iOS apps are affected in their most recent versions (3.3.7). The Android app has over 10,000,000 installs, the iOS app has 3.4K ratings and is the #198 app in the "Health & Fitness" category.
For example, during login, the app hashes the password entered by the user using SHA-1 locally on the device and then makes a POST request to the URL http://veryfitproapi.veryfitplus.com/user/login with a request body like this:
area=Europe&password=5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8&account=foo%40bar.com
The backend then parses the request body, comparing the hash value defined by the password key with the hash stored in the database in order to verify authentication of the user.
POST login request and replaces in the request body the hash value of password and the email address of account with the user's