VU#124705: BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities

Publisher excerpt From CERT/CC Vulnerability Notes

Overview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity. Description BaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application. VU#124705.1: The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks. VU#124705.2: Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata. VU#124705.3: The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous. Impact Impacts of successful exploitation vary by vulnerability. VU#124705.1: A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft. VU#124705.2: An attacker can locate the public RevenueCat SDK key and query the RevenueCat API using arbitrary phone numbers to retrieve associated user metadata, including activity and purchase history. VU#124705.3: The personal data, or PII, of other users, intended to be anonymous, can be accessed through local system logs. The application’s backend sending other users’ MSISDNs to the client in any capacity presents a privacy violation. These vulnerabilities have been confirmed against Basechat – Audio Dating App, Android version 9.8.1. Solution Unfortunately, Mobile Trading GmbH, the owners of BaseChat, could not be reached to coordinate this vulnerability. Acknowledgements Thanks to Mahmoud Ali Khan for reporting these vulnerabilities. This document was written by Alex Lewis.

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.