Anveo Mobile User Enumeration / Missing Certificate Validation

`SEC Consult Vulnerability Lab Security Advisory < 20231128-0 >  
=======================================================================  
title: Missing Certificate Validation & User Enumeration  
product: Anveo Mobile App and Server  
vulnerable version: Mobile App: 10.0.0.359 / 2016-07-13; Server: 11.0.0.5  
fixed version: -  
CVE number: -  
impact: Medium  
homepage: https://www.anveogroup.com/en/mobile-apps-for-dynamics/  
found: 2023-05-28  
by: Daniel Hirschberger (Office Bochum)  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"Create your own individual Mobile App with Anveo. Our base, out of the box  
solutions offer many useful functions, and can be flexibly adapted to your  
requirements: the Anveo Service App, Anveo Sales App, and Anveo Delivery App.  
You are looking for a mobile App for a different scenario? Not a problem with  
the Anveo Mobile App Builder! Thanks to the toolkit character of the solution,  
configuration of a completely new, custom App is simple."  
  
Source: https://www.anveogroup.com/en/mobile-apps-for-dynamics/  
  
  
Business recommendation:  
------------------------  
The vendor was unresponsive and did not reply to our communication attempts and even  
deleted our comment to request a contact on LinkedIn, see the timeline section further  
below.  
  
There is no solution known to us for this security issue. In case you are a customer  
of Anveo, request an update from them about the issue.  
  
Furthermore, an in-depth security analysis performed by security professionals is  
highly advised, as the software may be affected from other security issues.  
  
  
Vulnerability overview/description:  
-----------------------------------  
1) Missing Certificate Validation  
The Windows application was tested which does not perform certificate validation  
and is therefore vulnerable to man-in-the-middle attacks which might allow an  
attacker to gain access to sensitive data.  
  
  
2) User Enumeration  
The login is vulnerable to user enumeration because the error message for a  
non-existent user differs from the error message when a user exists. This allows  
an attacker to perform targeted brute-force attacks and potentially take over  
other user accounts.  
  
  
Proof of concept:  
-----------------  
1) Missing Certificate Validation  
The application does not validate the server certificate. To verify this,  
a new self-signed certificate was created with the openssl commandline tool.  
  
Afterwards, an openssl server was spawned with netcat:  
  
[ POC removed]  
  
When adding a new account in the application with the IP and port of this server,  
a connection is attempted. Now a special string has to be sent from the netcat  
listener to the client.  
  
As a response, the client tries to authenticate against the server with the  
username and password:  
  
<img certificate_validation.png>  
  
The part between <EOS> and <EOSC> can be base64-decoded and decompressed with  
zlib which yields the following output:  
  
[ POC removed ]  
  
The "PW" Parameter contains the base64-encoded password, in this case "unknown".  
  
  
2) User Enumeration  
When a non-existent user tries to login, the error message shows "Cannot find  
user":  
  
<img user_nonexistent.png>  
  
When a valid username but a wrong password is submitted, the server responds  
with "Username or password is not correct":  
  
<img user_exists.png>  
  
  
Vulnerable / tested versions:  
-----------------------------  
The following version has been tested:  
* Application version 10.0.0.359 / 2016-07-13 (the Windows version was tested)  
  
The vendor did not respond to our communication attempts, hence it is unknown whether  
further versions are affected as well.  
  
  
Vendor contact timeline:  
------------------------  
2023-06-12: Contacting vendor through email [email protected]  
Asking for security contact, no response  
2023-06-26: Contacting vendor through same email again, no response.  
2023-07-24: Contacting vendor through technical support email [email protected]  
Asking for security contact again, no response.  
2023-09-15: Contacting vendor again through [email protected], [email protected]  
and [email protected]. Ticket got automatically created, but no  
response.  
2023-09-19: Posted a message/comment on LinkedIn at Anveo Group to contact us. Besides a  
few profile views from employees (Team Lead Anveo Mobile App, Social Media  
Marketing, CEO) no response.  
Our comment then got deleted by Anveo Group.  
Comment:  
"Hi Anveo Group, we have been trying to reach your company since June through  
our responsible disclosure process as we have identified some security  
issues in your products. We never received any response via multiple email  
addresses (found on your website). Could you please get in touch with us and  
provide us with a person responsible for security? Thank you!"  
2023-09-20: Contacting third party whether they received a patch; no response.  
2023-10-09: Contacting again; no response.  
2023-10-23: Contacting again; no response.  
2023-11-17: Final attempt, asked third party for info again, tried to contact  
"[email protected]" through ticket again. No response from vendor, but  
third party replied, that they also did not receive any response from Anveo.  
2023-11-28: Public release of security advisory.  
  
  
Solution:  
---------  
The vendor was unresponsive and did not reply to our communication attempts and even  
deleted our comment to request a contact on LinkedIn, see the timeline section.  
  
There is no solution known to us for this security issue. In case you are a customer  
of Anveo, request an update from them about the issue.  
  
Furthermore, an in-depth security analysis performed by security professionals is  
highly advised, as the software may be affected from other security issues.  
  
  
Workaround:  
-----------  
None  
  
  
Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF Daniel Hirschberger / @2023  
`