Omarchy-Big-PC
358027bf27
- PROTOCOL.md: base URL, login/session auth, request envelope, push, media - endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle - FINDINGS.md: security findings incl. hardcoded dev account in build - tools: endpoint extractor + credential-safe login script - results: original analysis report (IDs redacted)
2.1 KiB
Security findings (com.botieducation.greenwood 2.4.14)
Vendor: Boti Education (boti.education). All findings from static analysis of the publicly distributed APK; one live login call used to verify the protocol.
F1. Hardcoded credentials in the shipped production build [HIGH]
extracted/assets/public/1028.js (login page component) contains:
this.reconnectUser = {id:12745, phone:"0649014703", password:"0649014703"}
This is a leftover dev/demo biometric-reconnect account with phone number as password, compiled into the production bundle. Anyone with the APK has a username and password. Status of this account on the server unknown; report to vendor recommended.
F2. Plaintext credential transmission [MEDIUM]
POST /login sends the password as a plaintext form field (password=...). TLS protects the transport, but the credential sits in plaintext in any intermediary logging form data, and the same pattern is reused by forgot-password / change-password. No client-side hashing. Common for this class of app, still worth flagging.
F3. Verbose production logging [LOW]
The ApiService logs request payloads, headers and the access token to console.log in the release build (visible via adb logcat / remote WebView debugging if enabled).
F4. No certificate pinning, no obfuscation [INFO]
No pinning config in the bundle, no network_security_config restrictions beyond defaults, JS bundle fully readable. RE cost: about an hour.
F5. Broad but plausible permissions [INFO]
CAMERA, fine+coarse LOCATION, microphone (voice recorder plugin), external storage, FCM. Location use case is bus tracking (pick endpoints); camera for photo upload. No SMS, contacts, or accessibility permission abuse observed.
Responsible disclosure notes
- Vendor contact is via boti.education; the school itself (Green Wood School, tel 0520744100 per the official welcome message) can escalate.
- F1 is the only finding with direct account-takeover potential and is trivially verifiable by the vendor.
- Do not test F1 against the live server beyond confirming it exists in the bundle; that crosses into unauthorized access.