Websea security record

The Android application includes a hardcoded encryption key within the source code. This key is used to encrypt and decrypt sensitive data stored locally on the device. Embedding cryptographic keys directly into the application makes them easily retrievable by anyone with access to the APK, such as through reverse engineering or decompilation.

When installing the Android application and analyzing the AndroidManifest.xml file, it was found that the application requests access to more permissions than what was expected. Specifically, the application requests the following unnecessary/dangerous permissions: ```xml <uses-permission android:name="android.permission.REORDER_TASKS" /> <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" /> <uses-permission android:name="android.permission.INTERNET" /> <uses-permission android:name="android.permission.VIBRATE" /> <uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES" /> <uses-permission android:name="android.permission.CAMERA" /> <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" /> <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" /> <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" /> <uses-permission android:name="android.permission.FLASHLIGHT" /> <uses-permission android:name="android.permission.USE_BIOMETRIC" /> <uses-permission android:name="android.permission.USE_FINGERPRINT" /> <uses-permission android:name="android.permission.GET_TASKS" /> <uses-permission android:name="android.permission.READ_PRIVILEGED_PHONE_STATE" /> <uses-permission android:name="android.permission.READ_PHONE_STATE" /> <uses-permission android:name="android.permission.RECEIVE_USER_PRESENT" /> <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE" android:maxSdkVersion="32" /> <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE" android:maxSdkVersion="32" /> <uses-permission android:name="android.permission.READ_MEDIA_IMAGES" /> <uses-permission android:name="android.permission.READ_MEDIA_VIDEO" /> <uses-permission android:name="android.permission.FOREGROUND_SERVICE" /> <uses-permission android:name="android.permission.RECORD_AUDIO" /> <uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION" /> <uses-permission android:name="android.permission.ACCESS_FINE_LOCATION" /> <uses-permission android:name="android.permission.NFC" /> <uses-feature android:name="android.hardware.camera" android:required="true" /> <uses-feature android:name="android.hardware.nfc" android:required="false" /> <uses-permission android:name="android.permission.WRITE_SETTINGS" /> <uses-permission android:name="android.permission.READ_MEDIA_AUDIO" /> <uses-permission android:name="android.permission.POST_NOTIFICATIONS" /> <uses-permission android:name="android.permission.WAKE_LOCK" /> <uses-permission android:name="com.google.android.c2dm.permission.RECEIVE" /> <uses-permission android:name="com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE" /> <uses-permission android:name="com.google.android.gms.permission.AD_ID" /> <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS" /> <uses-permission android:name="android.permission.BLUETOOTH" android:maxSdkVersion="30" /> <uses-permission android:name="android.permission.BLUETOOTH_CONNECT" /> <uses-permission android:name="com.asus.msa.SupplementaryDID.ACCESS" /> <uses-permission android:name="freemme.permission.msa" /> <uses-feature android:name="android.hardware.camera.autofocus" android:required="false" /> <uses-feature android:name="android.hardware.camera.flash" android:required="false" /> ``` The most intrusive permissions are the following: - **android.permission.SYSTEM_ALERT_WINDOW:** Allows an application to show system-alert windows. Applications can force themselves to the front without your control. - **android.permission.CAMERA:** Allows applications to take pictures and videos with the camera at all times. - **android.permission.GET_TASKS:** Allows applications to retrieve information about the currently and recently running tasks. May allow applications to discover private information about other applications. - **android.permission.READ_PHONE_STATE:** Allows applications to access the phone features of the device. An application with this permission can determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and so on. - **android.permission.WRITE/READ_EXTERNAL_STORAGE:** Allows applications to read and write to the external storage. - **android.permission.READ_MEDIA_IMAGES/VIDEO/AUDIO:** Allows applications to read image/video/audio files from external storage. - **android.permission.RECORD_AUDIO:** Allows applications to access the audio record path. - **android.permission.ACCESS_COARSE_LOCATION:** Allows coarse location sources, such as the mobile network database, to determine an approximate phone location, where available. Applications can use this to determine where you are and may consume additional battery power - **android.permission.WRITE_SETTINGS:** Applications can modify the system's settings data, potentially corrupting it. - **android.permission.BLUETOOTH_CONNECT:** Applications can read and pair to Bluetooth devices

The application sends confidential information that uniquely identifies the device to multiple API endpoints, some may not be associated with WebSea. The information contained in the requests is the device IMEI, the user's IP, the API access token, the device token and the User ID / Pseudo ID.

Some pieces of information stored by the Websea Android application in memory were not erased from the device after a user successfully logged out. This could lead to the disclosure of sensitive information about the user, including their API access tokens and HTTP request responses. This increases the risk that sensitive information could be leaked if a device was lost or traded. Some of the preserved information after logging out was the tokens and identifying information generated by the initial user.

The Android application is designed to create a cryptographic key from the Keystore. However, the Keystore entries currently lack sufficient protection, as several security flags are not enabled: - `isTrustedUserPresenceRequired` - `isUserAuthenticationRequired` - `isUserAuthenticationRequirementEnforcedBySecureHardware` - `isUserConfirmationRequired` These flags are intended to ensure that the Keystore entries are protected against unauthorized access.

The application does not implement certificate pinning. Certificate pinning is the act of associating a host with its expected certificate within the application. When the application connects to the host, the stored certificate is compared to the certificate held by the remote host. If the two certificates do not match, the request is dropped. Currently, the application only verifies that the server presents a TLS certificate that is trusted by the Android or iOS trust stores, not validating that the TLS certificate is in fact the one known to be deployed on the servers.

The session cookies `EXUU` and `sharedToken` are not properly protected by the "HTTPOnly" and "SameSite" attributes.

The mobile applications store the session token in memory during the user session but fail to clear it upon logout. As a result, even after a successful logout, the session token remains accessible in the app's memory until the application is terminated or the memory is cleared by the system. If the device is lost, compromised, or transferred to another user, an attacker could potentially retrieve the session token and use it to re-authenticate or access protected resources without user consent.

The application is hosted behind Cloudflare, which by default adheres to the `Cache‑Control: max‑age=14400` header and will cache JSON responses for a duration of up to four hours. The endpoint `/webApi/user/detail` typically requires a valid `Token` header and returns user‑specific data in JSON format. However, because Cloudflare treats any URL ending in a common static‑file extension (for example, `.css`) as cacheable, appending a fake extension to the dynamic endpoint causes that sensitive JSON to be stored in the CDN cache. When a legitimate and authenticated user requests `/webApi/user/detail;asd.css`, Cloudflare fails to distinguish it from a benign CSS file request and consequently caches the entire JSON payload. Subsequently, an attacker can exploit this vulnerability by requesting the same URL without any credentials, thereby directly accessing the victim’s private data from Cloudflare’s cache. _The vulnerability was categorized as Informational risk because the session token is transmitted via the HTTP `Token` header. Therefore, even if the user accesses a malicious URL, the session token will not be sent, and sensitive user data will not be cached. However, it is recommended to address this issue to mitigate potential exploitation in future modifications to the application or in conjunction with other vulnerabilities._

The "JSESSIONID" cookies set by the web application were found without the `Secure` flag set, making the cookies more vulnerable to various attacks. The `Secure` cookie security flag, it notifies the browser that the cookie can only be sent through encrypted channels. In cases in which the HTTP requests are sent through a cleartext channel, the browser will not append the cookie to the HTTP request sent to the server.