Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86376209

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Document Title:
===============
Grindr 2.1.1 iOS Bug Bounty #2 - Denial of Service Software Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1418


Release Date:
=============
2015-05-02


Vulnerability Laboratory ID (VL-ID):
====================================
1418


Common Vulnerability Scoring System:
====================================
3.3


Product & Service Introduction:
===============================
Grindr, which first launched in 2009, has exploded into the largest and most popular all-male location-based social network out there. 
With more than 5 million guys in 192 countries around the world -- and approximately 10,000 more new users downloading the app 
every day -- you’ll always find a new date, buddy, or friend on Grindr. Grindr is a simple app that uses your mobile device’s 
location-based services to show you the guys closest to you who are also on Grindr. How much of your info they see is 
entirely your call.

(Copy of the Vendor Homepage: http://grindr.com/learn-more )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a local and remote denial of servie vulnerability in the official  Grindr v2.1.1 iOS mobile web-application.


Vulnerability Disclosure Timeline:
==================================
2015-01-22: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security)
2015-01-22: Vendor Notification (Grinder - Bug Bounty Program)
2015-02-02: Vendor Response/Feedback (Grinder - Bug Bounty Program)
2015-04-01: Vendor Fix/Patch (Grindr Developer Team - Reward: x  & Manager: x)
2015-05-04: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Grindr LLC
Product: Grinder - iOS Mobile Web Application (API) 2.2.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
A local and remote Denial of Service vulnerability has been discovered in the official Grindr v2.1.1 iOS mobile web-application.

The attacker injects a script code tag or multiple termination strings (%00%20%00%20%00) to the Display Name input field of the Edit Profile module.
After the inject the service stored the malicious values as DisplayName. After the inject a random user is processing to click in the profile the
contact information (facebook/twitter). After that the victim wants to copy the link and an internal service corruption occurs thats crashs the mobile app.
The issue is local and remote exploitable.

Vulnerable Module(s):
[+] Edit Profile

Vulnerable Parameter(s): (Input)
[+] Display Name

Affected Module(s):
[+] Contact > Social Network > Copy Link



Proof of Concept (PoC):
=======================
The denial of service web vulnerability can be exploited by remote attacker and local user accounts with low user interaction (click).
To demonstrate the vulnerability or to reproduce the issue follow the provided information and steps below to continue.

Manual steps to reproduce ...
1. Open the grindr mobile application
2. Inject a script code tag as Display Name or use the terminated String with empty values
3. Save and click in the profile the contact button (exp. facebook)
4. Click to the send button ahead and push the Copy Link function
5. The app service is getting terminated with an uncaught exception because of an internal parsing error

Note:To exploit the issue remotly the profile needs to be shared with another user and then the user only needs to push the same way the social contact button.

PoC Video: 


Solution - Fix & Patch:
=======================
First step is to prevent the issue by a secure restriction of the input. Attach a own excpetion-handling to prevent next to the insert itself. 
The social network accounts that are linked do not allow special chars in the username. The grindr ios app and the android app allows to register 
an account and to insert own scripts <html5> or null strings that corrupts the process of copy the link by an error. After the restriction has been 
set in the code of both (api) the issue can not anymore execute to shutdown anothers users account. Even if this issue execution is prevented that 
was only a solution to prevent. 

To fix the bug ...
Connect for example ios device with the running app to windows. Sync the process and reproduce the remote error and local error. Move to the iOS error 
folder that has been synced. Get the error attach another debugger and so on ...


Security Risk:
==============
The secuirty risk of the local and remote denial of service vulnerability in the copy link function that corrupts is estimated as medium.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, 
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@vulnerability-lab.com 	- research@vulnerability-lab.com 	       		- admin@evolution-sec.com
Section:    magazine.vulnerability-db.com	- vulnerability-lab.com/contact.php		       	- evolution-sec.com/contact
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

				Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

-- 
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt