Jose Lomeli

An insecure TLS/SSL certificate validation issue exists due to a custom X509TrustManager that trusts all certificates and a hostname verifier that accepts any hostname. This allows network-based attackers to perform a man-in-the-middle attack to intercept and modify HTTPS traffic. Such an attack can be used to capture account sessions and health-related API data, or to delete the authentication record of an account to prevent legitimate login.

The application lacks an Android network security configuration, which allows network-based attackers to intercept or modify unencrypted HTTP communications. This issue enables attackers on untrusted networks to manipulate support content displayed to the user by tampering with the cleartext traffic between the application and the server.

The application contains hardcoded credentials, which allows attackers to extract confidential third-party integration secrets by decompiling the APK (Android Package). This process enables the retrieval of embedded credentials for WeChat, Tencent QQ, and Fitbit to abuse active third-party application registrations.

Insecure session management allows the extraction or interception of unencrypted `m session id` tokens stored in application backups. These tokens remain valid for ten years, enabling an attacker to read and modify the victim's account or delete the authentication record to prevent the legitimate owner from logging in.

The application uses an insecure custom URI scheme that allows a malicious app to intercept Fitbit login tokens by registering the same callback scheme `vitafit://vtio.cn`. An attacker can capture the 30-day Fitbit authorization token with weight scope delivered in the callback URL, enabling them to read, create, and delete the victim's weight and body-fat records via the Fitbit Body API.

An insecure direct object reference allows authenticated attackers to access data belonging to other users. By exploiting predictable relationships between `user id` and `profile id` alongside an account-enumeration weakness, attackers can read email addresses, profiles, body-composition reports, and measurement history at scale. The issue affects the following endpoints: - 'GET /front/profile/{profile id}/report/' - 'GET /front/profile/{profile id}/body index per day/' The vulnerable parameters are `user id` and `profile id`.

Broken access control allows authenticated users to obtain temporary AWS credentials via the 'POST /front/user/s3/token/' endpoint. These credentials have overly broad scopes, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users, leading to unauthorized cross-user data access and manipulation.

An authenticated attacker can upload an SVG image containing malicious JavaScript to the shared storage bucket. The issue occurs because the application fails to restrict scripts or force downloads for `image/svg+xml` content, which allows the JavaScript to execute when a victim opens the file through direct browser navigation. This is a stored cross-site scripting (XSS) issue, where a malicious script is permanently stored on the target server.

A misconfigured cloud storage bucket allows unauthenticated attackers to list and download stored files. This issue enables the enumeration of a publicly accessible bucket containing 129,947 objects, including 126,881 user-uploaded profile images, leading to unauthorized access to sensitive personal data.

An improper access control issue exists in the Cognito-issued AWS role. This allows authenticated attackers to perform `s3:PutObject` operations across the entire shared bucket rather than being restricted to their own specific folder. Consequently, attackers can overwrite objects belonging to other users in the shared S3 bucket, which results in the destruction of original content without triggering deletion protections.

An excessive data exposure issue allows authenticated users to retrieve personally identifiable information (PII) and health-related profile data. By querying the 'GET /front/relation/search/' endpoint using overlapping alphanumeric search terms, attackers can enumerate the user directory to harvest emails, birthdays, gender, height, weight goals, phone numbers, Firebase UIDs, and other identifiers.

An authentication bypass allows remote attackers to obtain a full session for a victim's account. This is achieved by submitting a linked Google or Facebook account identifier to the 'POST /front/login/sns/' endpoint without providing proof of ownership from the identity provider. Attackers can use identifiers obtained through account enumeration to read and modify victim profiles or delete authentication records, which prevents legitimate users from accessing their accounts.