Auditing WriteDiary.com (CVE-2017-15581 & CVE-2017-15582)
General note: The developer and owner of both the webapp and android app has been contacted multiple times to develop a quick fix for the issues addressed in this blog post and a vulnerability concerning the webapp which isn't described here. However, no response has been received.
WriteDiary consists of a webapp (WriteDiary.com) and an android app (version 4.72). For the audit, the android app was the primary target.
Vulnerability type: Plaintext data transport
Affected Product Code Base: WriteDiary - 4.72
Affected Component: LoginActivity, NoteActivity*
Impact: Information Disclosure of sensitive data (diary entries, login data)
CVE-2017-15581: Lack of HTTPS-usage, lack of user data encryption when transmitting
In the "Diary with lock" (aka WriteDiary) application 4.72 for Android, neither HTTPS (check strings.xml for api_url_prod: http://diary.adpog.com/api2) nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of secrets and feelings," which allows remote attackers to obtain sensitive information by sniffing the network during LoginActivity or NoteActivity execution.
Vulnerability type: Plaintext data transport
Affected Product Code Base: WriteDiary - 4.72
Affected Component: LoginActivity, NoteActivity*
Impact: Information Disclosure of sensitive data (diary entries, login data)
CVE-2017-15582: Usage of static AES parameters
In net.MCrypt in the "Diary with lock" (aka WriteDiary) application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, which makes it easier for attackers to obtain the cleartext of stored diary entries:
Vulnerability type: Hard coded AES parameters
Affected Product Code Base: WriteDiary - 4.72
Affected Component: net.MCrypt
Impact: Information Disclosure of sensitive data (diary entries)
Affected Product Code Base: WriteDiary - 4.72
Affected Component: net.MCrypt
Impact: Information Disclosure of sensitive data (diary entries)