01/04/2024
TableofContents
Contents
1. TESTPARAMETERS.......................................................................................................................3
2. RESULTSUMMARY......................................................................................................................3
3. TESTTARGETS..............................................................................................................................4
4. RISKRESULTS...............................................................................................................................4
5. ASSESSMENTRESULTS.................................................................................................................5
SSL Pinning Bypasss........................................................................................................................5
Severity:.....................................................................................................................................5
Affected URL: ae.damanhealth.daman.........................................................................................5
Affected Parameter: None...........................................................................................................5
Payload:......................................................................................................................................5
Description:................................................................................................................................5
Impact........................................................................................................................................5
SSL pinning bypass techniques enable attackers to intercept and manipulate
sensitive data, compromising confidentiality, integrity, and potentially leading to
severe consequences such as data breaches and financial losses....................................5
Remediation...............................................................................................................................5
Proof Of Concept........................................................................................................................6
Service (com.wix.reactnativenotifications.fcm.FcmInstanceIdListenerService) is not Protected..........7
Severity:.....................................................................................................................................7
Affected URL: ae.damanhealth.daman.........................................................................................7
Affected Parameter:....................................................................................................................7
Payload: NONE............................................................................................................................7
Description:................................................................................................................................7
Impact........................................................................................................................................7
Leaving the service unprotected can lead to unauthorized access, data exposure,
security risks, user privacy violations, and application integrity issues, posing
significant risks to the security, privacy, and integrity of the application and its users.
...................................................................................................................................................7
Remediation...............................................................................................................................7
Proof Of Concept........................................................................................................................8
Janus Vulnerability.....................................................................................................................9
Severity:.....................................................................................................................................9
Affected URL:..............................................................................................................................9
1|Page
Description:................................................................................................................................9
The Janus vulnerability is a security flaw in Android apps that allows attackers to
inject malicious code into APK files without altering their cryptographic signatures.
This vulnerability enables attackers to modify the app's behavior or steal sensitive
data without being detected by the app's verification mechanisms...............................9
Application is signed with v1 signature scheme, making it vulnerable to Janus
vulnerability on Android 5.0-8.0, if signed only with v1 signature scheme.
Applications running on Android 5.0-7.0 signed with v1, and v2/v3 scheme is also
vulnerable................................................................................................................................9
Impact........................................................................................................................................9
The Janus vulnerability allows attackers to inject malicious code into Android apps
without invalidating their cryptographic signatures, enabling them to execute
unauthorized actions, steal data, and compromise user privacy and security...............9
Remediation...............................................................................................................................9
Proof Of Concept......................................................................................................................10
Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver).................................11
Severity:....................................................................................................................................11
Affected URL:............................................................................................................................11
Description:...............................................................................................................................11
Permission: com.google.android.c2dm.permission.SEND [android:exported=true]. .11
A Broadcast Receiver is found to be shared with other apps on the device therefore
leaving it accessible to any other application on the device. It is protected by a
permission which is not defined in the analysed application. As a result, the
protection level of the permission should be checked where it is defined. If it is set to
normal or dangerous, a malicious application can request and obtain the permission
and interact with the component. If it is set to signature, only applications signed
with the same certificate can obtain the permission.......................................................11
Impact......................................................................................................................................11
Broadcast receivers facilitate communication between Android components and
apps. However, if not secured properly, they can lead to unauthorized access, data
leakage, and privacy violations...........................................................................................11
Remediation.............................................................................................................................11
Unprotected broadcast receiver , check the permission defined on the application and ensure it
is set to signature , this ensure only applications signed with the same certificate can obtain the
permission................................................................................................................................11
Proof Of Concept......................................................................................................................12
2|Page
1. TESTPARAMETERS
TestStartDate 15/10/2024
TestEndDate 07/03/2024
TestTime 09:00–17:30IST
TestType Android Application
Test Technique BackBox
Test Limitations NoDos,NoLoadTesting,NoSocialEngineering
2. RESULTSUMMARY
RiskLevel RisksFound
Critical 0
High 2
Medium 2
Low 0
Total 4
RiskAnalytics
2.5
1.5
0.5
0
Critical High Medium Low
Critical High Medium Low
3|Page
3. TESTTARGETS
Applicatiuon: ae.damanhealth.daman
4. RISKRESULTS
VulnerabilityName Severity
SSL Pinning By Pass High
Service High
(com.wix.reactnativenotifications.fcm.FcmIns
tanceIdListenerService) is not Protected
Janus Vulnerability Medium
Broadcast Receiver Medium
4|Page
5. ASSESSMENTRESULTS
SSL Pinning Bypasss
Severity:
HIGH
Affected URL: ae.damanhealth.daman
Affected Parameter: None
Payload:
NONE
Description:
SSL pinning bypass techniques include exploiting pinning implementation flaws, dynamic
instrumentation with tools like Frida, reverse engineering for extracting keys, hooking libraries, using
MITM proxies, and employing custom SSL trust managers.
Impact
SSL pinning bypass techniques enable attackers to intercept and manipulate sensitive data,
compromising confidentiality, integrity, and potentially leading to severe consequences such as data
breaches and financial losses.
Remediation
To mitigate pinning bypass on Android applications, the following steps can be taken:
1. Ensure that SSL pinning is correctly implemented in the application, using trusted and authorized
certificates. Follow
best practices for SSL pinning to make it harder to bypass.
2. Apply code obfuscation techniques to make it difficult for attackers to understand and modify the
app’s code, including
the SSL pinning implementation.
3. Utilize Runtime Application Self-Protection (RASP) solutions that monitors and defends against
dynamic attacks,
including SSL pinning bypass attempts.
4. Employ techniques like checksum verification, code integrity checks, or binary hardening to detect
and prevent modifi-
cations to the application’s code or resources.
5|Page
Proof Of Concept
6|Page
Service (com.wix.reactnativenotifications.fcm.FcmInstanceIdListenerService) is not Protected
Severity:
HIGH
Affected URL: ae.damanhealth.daman
Affected Parameter:
Payload: NONE
Description:
A Service is found to be shared with other apps on the device therefore leaving it accessible to any
other application on the device.
Impact
Leaving the service unprotected can lead to unauthorized access, data exposure, security risks, user
privacy violations, and application integrity issues, posing significant risks to the security, privacy, and
integrity of the application and its users.
Remediation
To remediate the unprotected service:
Set android:exported to false.
Review and limit intent filters.
Apply permission checks.
Conduct a security review.
Perform regular security audits.
7|Page
Proof Of Concept
8|Page
Janus Vulnerability
Severity:
MEDIUM
Affected URL:
Description:
The Janus vulnerability is a security flaw in Android apps that allows attackers to inject malicious code
into APK files without altering their cryptographic signatures. This vulnerability enables attackers to
modify the app's behavior or steal sensitive data without being detected by the app's verification
mechanisms.
Application is signed with v1 signature scheme, making it vulnerable to Janus vulnerability on Android
5.0-8.0, if signed only with v1 signature scheme. Applications running on Android 5.0-7.0 signed with v1,
and v2/v3 scheme is also vulnerable.
Impact
The Janus vulnerability allows attackers to inject malicious code into Android apps without invalidating
their cryptographic signatures, enabling them to execute unauthorized actions, steal data, and
compromise user privacy and security.
Remediation
Janus vulnerability by implementing signature verification checks at runtime, regularly updating apps
with security patches, and utilizing code obfuscation techniques to thwart malicious injection attempts.
9|Page
Proof Of Concept
10|Page
Broadcast Receiver (com.google.firebase.iid.FirebaseInstanceIdReceiver)
Severity:
MEDIUM
Affected URL:
Description:
Permission: com.google.android.c2dm.permission.SEND [android:exported=true]
A Broadcast Receiver is found to be shared with other apps on the device therefore leaving it accessible
to any other application on the device. It is protected by a permission which is not defined in the
analysed application. As a result, the protection level of the permission should be checked where it is
defined. If it is set to normal or dangerous, a malicious application can request and obtain the
permission and interact with the component. If it is set to signature, only applications signed with the
same certificate can obtain the permission.
Impact
Broadcast receivers facilitate communication between Android components and apps. However, if not
secured properly, they can lead to unauthorized access, data leakage, and privacy violations.
Remediation
Unprotected broadcast receiver , check the permission defined on the application and ensure it is set
to signature , this ensure only applications signed with the same certificate can obtain the permission
11|Page
Proof Of Concept
12|Page
