Omarchy-Big-PC
358027bf27
- PROTOCOL.md: base URL, login/session auth, request envelope, push, media - endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle - FINDINGS.md: security findings incl. hardcoded dev account in build - tools: endpoint extractor + credential-safe login script - results: original analysis report (IDs redacted)
50 lines
2.1 KiB
Markdown
50 lines
2.1 KiB
Markdown
# Security findings (com.botieducation.greenwood 2.4.14)
|
|
|
|
Vendor: Boti Education (boti.education). All findings from static analysis of
|
|
the publicly distributed APK; one live login call used to verify the protocol.
|
|
|
|
## F1. Hardcoded credentials in the shipped production build [HIGH]
|
|
|
|
extracted/assets/public/1028.js (login page component) contains:
|
|
|
|
this.reconnectUser = {id:12745, phone:"0649014703", password:"0649014703"}
|
|
|
|
This is a leftover dev/demo biometric-reconnect account with phone number as
|
|
password, compiled into the production bundle. Anyone with the APK has a
|
|
username and password. Status of this account on the server unknown; report to
|
|
vendor recommended.
|
|
|
|
## F2. Plaintext credential transmission [MEDIUM]
|
|
|
|
POST /login sends the password as a plaintext form field (password=...).
|
|
TLS protects the transport, but the credential sits in plaintext in any
|
|
intermediary logging form data, and the same pattern is reused by
|
|
forgot-password / change-password. No client-side hashing. Common for this
|
|
class of app, still worth flagging.
|
|
|
|
## F3. Verbose production logging [LOW]
|
|
|
|
The ApiService logs request payloads, headers and the access token to
|
|
console.log in the release build (visible via adb logcat / remote WebView
|
|
debugging if enabled).
|
|
|
|
## F4. No certificate pinning, no obfuscation [INFO]
|
|
|
|
No pinning config in the bundle, no network_security_config restrictions
|
|
beyond defaults, JS bundle fully readable. RE cost: about an hour.
|
|
|
|
## F5. Broad but plausible permissions [INFO]
|
|
|
|
CAMERA, fine+coarse LOCATION, microphone (voice recorder plugin), external
|
|
storage, FCM. Location use case is bus tracking (pick endpoints); camera for
|
|
photo upload. No SMS, contacts, or accessibility permission abuse observed.
|
|
|
|
## Responsible disclosure notes
|
|
|
|
- Vendor contact is via boti.education; the school itself (Green Wood School,
|
|
tel 0520744100 per the official welcome message) can escalate.
|
|
- F1 is the only finding with direct account-takeover potential and is
|
|
trivially verifiable by the vendor.
|
|
- Do not test F1 against the live server beyond confirming it exists in the
|
|
bundle; that crosses into unauthorized access.
|