Document Title: =============== Wincor Nixdorf PC/E Mobile Cash TryOut - API Vulnerability References (Source): ==================== https://www.vulnerability-lab.com/get_content.php?id=2002 Release Date: ============= 2018-01-03 Vulnerability Laboratory ID (VL-ID): ==================================== 2002 Common Vulnerability Scoring System: ==================================== 3.1 Vulnerability Class: ==================== Privacy Violation - Information Disclosure Current Estimated Price: ======================== 500€ - 1.000€ Product & Service Introduction: =============================== With Mobile Cash you are able to initiate banking transactions securely and easily with your smartphone at home or on the way and close it later, whenever you want at the ATM or in the branch. Because of preparing transactions, like cash withdrawals or money transfers via smartphone, your residence time in the branch or self-service zone will become considerably shorter. (Copy of the Homepage: https://itunes.apple.com/us/app/pc-e-mobile-cash-tryout/id561707540 ) Abstract Advisory Information: ============================== Das Evolution Security Research Team hat eine Sicherheitslücke in der Wincor Nixdorf PC/E Mobile Cash TryOut v1.1 ios application. Vulnerability Disclosure Timeline: ================================== 2017-04-01: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Wincor Nixdorf Product: PC/E Mobile Cash TryOut - Mobile (Web-Application) 1.1 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ An information disclosure vulnerability has been revealed in the official Wincor Nixdorf PC / E Mobile Cash TryOut v1.1 ios application. The vulnerability allows attackers to access sensitive information in the context of Wincor Nixdorf's mobile application. The security gap is in the function for forwarding the phone number to the bank itself To send their own telephone number to the respective bank as part of the second step of the application. If you do this You get the username and password of the interface via the referer in the cookie with the GeoLocation. attacker Could use this information to transfer sensitive data from customers or manipulate them. When sending, an error is generated in the code (Error.0). This is followed by the error with the referer as output. When entering wrong Information or invalid connection is output to the cookie with the plain information (location, user name & password). Proof of Concept (PoC): ======================= Manual Steps to Reproduce the Security Gap 1. Install the application v1.1 on the mobile apple ios Tets device 2. Open the application to start the application 3. Now you move by touch to verify the banks via telephone number 4. Now insert an invalid phone number 5. Then press the send / ok button to send the registration 6. An error code with the number 0 appears 7. There follows another error from the referer which contains the location and password data from the API 8. Successful reproduction of the information disclosure security gap! Solution - Fix & Patch: ======================= The vulnerability is marked as known and resolved by the manufacturer wincor nixdorf (diebold nixdorf) during the year 2017. Security Risk: ============== The security risk of the information disclosure issue in the mobile web-application is estimated as medium (CVSS 3.1). Credits & Authors: ================== Vulnerability-Lab [admin@vulnerability-lab.com] - https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability Labs or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for incidental or consequential damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data. We have no need for criminal activities or membership requests. We do not publish advisories or vulnerabilities of religious-, militant- and racist- hacker/analyst/researcher groups or individuals. We do not publish trade researcher mails, phone numbers, conversations or anything else to journalists, investigative authorities or private individuals. Domains: www.vulnerability-lab.com - www.vulnerability-db.com - www.evolution-sec.com Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get an ask permission. Copyright © 2018 | Vulnerability Laboratory - [Evolution Security GmbH]™