Websea Exchange

The exchange implements IP-based rate limiting across many of its devices, our analysis found that the IP can be forged using the "X-Forwarded-For" header. This happens because a front-end proxy, seemingly an Amazon Web Services Web Application Firewall, is reading the client IP from "X-Forwarded-For", trusting it and passing it to the exchange's services. The Web Application Firewall should only read the IP from "X-Forwarded-For" if it is situated behind a web server or load balancer which strips this header from the client-side request and appends it after correctly identifying the user. Moreover, it was discovered that the Web Application Firewall tries to DNS resolve domains in order to obtain the source IP address. Only certain domains belonging to the exchange try to resolve the attacker-provided domain but the rate limiting bypass is available on all of the services.

The API key in the application can be considered highly sensitive information. Anyone with access to the API key can move funds from the account and manage assets. The application creates a web-view to a URL which has the secret token appended as a GET parameter. The client-side JavaScript code then reads the token from the parameter and appends it as an HTTP header in subsequent API requests. The application's `AndroidManifest.xml` also has the flag `android:usesCleartextTraffic="true"` which allows requests over HTTP, without SSL/TLS, which can expose the token to Man-in-the-Middle attacks (for example: when using a public Wi-Fi network).

The file at `https://www.websea.com/analysis/index.html` contains a previously emitted API access token as well as internal IPs for one of the project's API endpoints. It also contains other comments and raw Vue.js code, allowing attackers to potentially exploit logic which should only be available server-side.

Android application stores sensitive information in plaintext on the files located in `/data/user/0/com.websea.exchange/shared_prefs`. These files include the user's access token, IP, User ID, Auth Token, etc.