Wincor Nixdorf PC/E Mobile Cash TryOut - API Vulnerability

Document Title:
===============
Wincor Nixdorf PC/E Mobile Cash TryOut - API Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2002


Release Date:
=============
2018-01-03


Vulnerability Laboratory ID (VL-ID):
====================================
2002


Common Vulnerability Scoring System:
====================================
3.1


Vulnerability Class:
====================
Privacy Violation - Information Disclosure


Current Estimated Price:
========================
500€ - 1.000€


Product & Service Introduction:
===============================
With Mobile Cash you are able to initiate banking transactions securely and easily with your smartphone at home or on the way and close it later, 
whenever you want at the ATM or in the branch. Because of preparing transactions, like cash withdrawals or money transfers via smartphone, your 
residence time in the branch or self-service zone will become considerably shorter.

(Copy of the Homepage: https://itunes.apple.com/us/app/pc-e-mobile-cash-tryout/id561707540 )


Abstract Advisory Information:
==============================
Das Evolution Security Research Team hat eine Sicherheitslücke in der Wincor Nixdorf PC/E Mobile Cash TryOut v1.1 ios application.


Vulnerability Disclosure Timeline:
==================================
2017-04-01:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Wincor Nixdorf
Product: PC/E Mobile Cash TryOut - Mobile (Web-Application) 1.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
An information disclosure vulnerability has been revealed in the official Wincor Nixdorf PC / E Mobile Cash TryOut v1.1 ios application.
The vulnerability allows attackers to access sensitive information in the context of Wincor Nixdorf's mobile application.

The security gap is in the function for forwarding the phone number to the bank itself
To send their own telephone number to the respective bank as part of the second step of the application. If you do this
You get the username and password of the interface via the referer in the cookie with the GeoLocation. attacker
Could use this information to transfer sensitive data from customers or manipulate them.
When sending, an error is generated in the code (Error.0). This is followed by the error with the referer as output. When entering wrong
Information or invalid connection is output to the cookie with the plain information (location, user name & password).


Proof of Concept (PoC):
=======================
Manual Steps to Reproduce the Security Gap
1. Install the application v1.1 on the mobile apple ios Tets device
2. Open the application to start the application
3. Now you move by touch to verify the banks via telephone number
4. Now insert an invalid phone number
5. Then press the send / ok button to send the registration
6. An error code with the number 0 appears
7. There follows another error from the referer which contains the location and password data from the API
8. Successful reproduction of the information disclosure security gap!


Solution - Fix & Patch:
=======================
The vulnerability is marked as known and resolved by the manufacturer wincor nixdorf (diebold nixdorf) during the year 2017.


Security Risk:
==============
The security risk of the information disclosure issue in the mobile web-application is estimated as medium (CVSS 3.1).


Credits & Authors:
==================
Vulnerability-Lab [[email protected]] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or 
implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any 
case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its 
suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental
or consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface 
websites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories 
or vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails, 
phone numbers, conversations or anything else to journalists, investigative authorities or private individuals. 

Domains:    www.vulnerability-lab.com		- www.vulnerability-db.com					- www.evolution-sec.com
Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab

Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission.

				    Copyright © 2018 | Vulnerability Laboratory - [Evolution Security GmbH]™