Mediafire Andriod App Leaking Sensitive User Data

[ads]

Mediafire Andriod App Leaking Sensitive User Data – Bug Bounty POC

Hello Bug Bounty POC Viewers Hope you are all in good health. . This is Arbaz Hussain and today  i will be sharing one of my recent finding in Mediafire Android Application. So lets come to the issue, Basically it was an INSECURE LOGGING Which Leaks Email & Password with HTTP Response in Plain Text. One Night I Was Testing For Small Vulnerabilities , . Many of our researchers are testing for Vulnerabilities in Mediafire Web Application , So i Just Skip it And Started Digging Their Android App . The First Thing i Test for is INSECURE Data Store Which is Most Common By Checking Any Juicy information is Been Saved in Plain Texts Anywhere in Directories , I Tried but Didn’t Found Anything Interesting , Then i Started Testing For Data Leakage And Found Out That  While Loging in  Into Mediafire

Though Android App Whole HTTP Response Along With Email & Passwords are Leaking  in plain text Though Android logs which means any app which can read logs can also read Mediafire username and passwords.. Apps like logcat and many others can b used. ( those are apps which doesn’t  Even need root access).

Android Maintains a Centralised logcat for all apps running on the device, which is Most Commonly used by Developers for Debugging purposes.Tested By Using ADB Logcat. So Always  wherenever u r creating a application you should ensure that u r not logging sensitive information in Production build of application.

Tip For Testing Logging Issues :

adb shell ps | grep -i  ‘Your Android App Name ‘

adb shell logcat | grep [pid]
Example :-

1. adb shell ps | grep -i ‘Mediafire’

Ubuntu@ >>    22

2. adb shell logcat | grep 22

Reward : Undisclosed + Certificate + Pro Plan