Vulnerability-Lookup

CNVD-2021-25679

Vulnerability from cnvd - Published: 2021-04-08

Title

Longbrothers Digital OKLOK信息泄露漏洞（CNVD-2021-25679）

Description

Longbrothers Digital Fingerprint Bluetooth Padlock FB50和OKLOK都是中国龙兄弟数码（Longbrothers Digital）公司的产品。Fingerprint Bluetooth Padlock FB50是一款指纹圆挂锁，它支持指纹解锁、远程授权开锁、查询开锁记录等功能。OKLOK是一款用于管理电子锁的移动应用程序。 Longbrothers Digital OKLOK 3.1.1中存在信息泄露漏洞，攻击者可借助已认证但未授权的令牌利用该漏洞以任意用户ID提交未授权的API请求，获取邮件地址，未加盐的MD5散列密码等。

Severity

中

Formal description

厂商尚未提供漏洞修补方案，请关注厂商主页及时更新： http://www.oklok.com.cn/index.php

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-8791

Impacted products

Name
Longbrothers Digital OKLOK 3.1.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-8791"
    }
  },
  "description": "Longbrothers Digital Fingerprint Bluetooth Padlock FB50\u548cOKLOK\u90fd\u662f\u4e2d\u56fd\u9f99\u5144\u5f1f\u6570\u7801\uff08Longbrothers Digital\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Fingerprint Bluetooth Padlock FB50\u662f\u4e00\u6b3e\u6307\u7eb9\u5706\u6302\u9501\uff0c\u5b83\u652f\u6301\u6307\u7eb9\u89e3\u9501\u3001\u8fdc\u7a0b\u6388\u6743\u5f00\u9501\u3001\u67e5\u8be2\u5f00\u9501\u8bb0\u5f55\u7b49\u529f\u80fd\u3002OKLOK\u662f\u4e00\u6b3e\u7528\u4e8e\u7ba1\u7406\u7535\u5b50\u9501\u7684\u79fb\u52a8\u5e94\u7528\u7a0b\u5e8f\u3002 \n\nLongbrothers Digital OKLOK 3.1.1\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u501f\u52a9\u5df2\u8ba4\u8bc1\u4f46\u672a\u6388\u6743\u7684\u4ee4\u724c\u5229\u7528\u8be5\u6f0f\u6d1e\u4ee5\u4efb\u610f\u7528\u6237ID\u63d0\u4ea4\u672a\u6388\u6743\u7684API\u8bf7\u6c42\uff0c\u83b7\u53d6\u90ae\u4ef6\u5730\u5740\uff0c\u672a\u52a0\u76d0\u7684MD5\u6563\u5217\u5bc6\u7801\u7b49\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u8865\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttp://www.oklok.com.cn/index.php",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-25679",
  "openTime": "2021-04-08",
  "products": {
    "product": "Longbrothers Digital OKLOK 3.1.1"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-8791",
  "serverity": "\u4e2d",
  "submitTime": "2020-05-06",
  "title": "Longbrothers Digital OKLOK\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2021-25679\uff09"
}

CVE-2020-8791 (GCVE-0-2020-8791)

Vulnerability from cvelistv5 – Published: 2020-05-04 13:22 – Updated: 2024-08-04 10:12

Summary

The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

1 reference

URL	Tags
https://github.com/fierceoj/ownklok	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T10:12:10.943Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/fierceoj/ownklok"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-05-04T13:22:14.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fierceoj/ownklok"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-8791",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The OKLOK (3.1.1) mobile companion app for Fingerprint Bluetooth Padlock FB50 (2.3) allows remote attackers to submit API requests using authenticated but unauthorized tokens, resulting in IDOR issues. A remote attacker can use their own token to make unauthorized API requests on behalf of arbitrary user IDs. Valid and current user IDs are trivial to guess because of the user ID assignment convention used by the app. A remote attacker could harvest email addresses, unsalted MD5 password hashes, owner-assigned lock names, and owner-assigned fingerprint names for any range of arbitrary user IDs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/fierceoj/ownklok",
              "refsource": "MISC",
              "url": "https://github.com/fierceoj/ownklok"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-8791",
    "datePublished": "2020-05-04T13:22:14.000Z",
    "dateReserved": "2020-02-07T00:00:00.000Z",
    "dateUpdated": "2024-08-04T10:12:10.943Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2021-25679

CVE-2020-8791 (GCVE-0-2020-8791)

Tags

Sightings

Nomenclature