Message-ID: <dedc81a0-39b7-41d5-a9c6-4012d75cb193@sec-consult.com>
Date: Thu, 18 Apr 2024 11:11:48 +0000
From: SEC Consult Vulnerability Lab via Fulldisclosure
 <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20240418-0 :: Broken authorization in
	Dreamehome app

SEC Consult Vulnerability Lab Security Advisory < 20240418-0 >
=======================================================================
               title: Broken authorization
             product: Dreamehome app
  vulnerable version: <=2.1.5 (iOS)
       fixed version: none, see solution
          CVE number: -
              impact: medium
            homepage: https://www.dreametech.com
               found: 2024-01-17
                  by: Alissa Kim (Office Bochum)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Eviden business
                      Europe | Asia

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"We've emerged as one of the leading brands in smart home cleaning with
our 4 major product lines: robotic vacuums and mops, cordless stick vacuums,
wet and dry vacuums, and high-speed hair dryers. Each product is meticulously
designed to redefine convenience in household innovation and improve our
users' homes."

Source: https://www.dreametech.com/pages/about-us


Business recommendation:
------------------------
The vendor was unresponsive/uncooperative during multiple months of trying to
establish a security contact and to send them our findings. There is no patch/
solution available. Try to contact your local support team and request a patch
for this issue. Stay up-to-date with firmware and app installations and be vigilant.

SEC Consult highly recommends to perform a thorough security review of the product
conducted by security professionals to identify and resolve potential further
security issues.


Vulnerability overview/description:
-----------------------------------
1) Broken authorization
An owner of the robot vacuum cleaner device can share it with other users via the
app. The privileges of the shared users are very limited. It is not possible to
interact with photos and videos from within the mobile application, but it was
identified that it is possible to delete and list all images/videos of the main
account and even download the encrypted images/videos by sending the requests
with the JWT of the shared user. The encryption was not reverse-engineered but
it could potentially be possible for unauthorized users to gain access to sensitive
imaging data.


Proof of concept:
-----------------
1) Broken authorization
To exploit the vulnerability it is sufficient to follow these steps:
1. Connect a robot vacuum cleaner to the Dreamehome app (in our case the device
    "Dreame L10S ultra" was used).
2. Take a photo and video with the Dreamehome app using the connected device.
3. Share the robot vacuum cleaner with another user.
4. The "shared user" can list the photos using the following curl command:
    (It is necessary to set the "did" of the device)

[ POC removed]

5. The "shared user" can list the videos using the following curl command:

[POC removed]

6. The response with the list of photos/videos contains an "id" parameter. Knowing
this "id" parameter, a shared user can delete the photos/videos using the value
of "id" in the "ossIds" parameter using the following command:

[POC removed]

7. Furthermore, the responses with the list of photos/videos contains a "filepath"
parameter with the URL to the encrypted photo/video. Any user even without a valid JWT
token can download the encrypted photo/video using this URL. The encryption was not
reverse-engineered but it could potentially be possible for unauthorized users to gain
access to sensitive imaging data.


Vulnerable / tested versions:
-----------------------------
The following versions have been tested which were the latest version available
at the time of the test:
* Dreamehome app 2.1.0 (tested with Dreame L10S ultra device)
* Dreamehome app 2.1.5 was tested later on 2024-04-12 and found to be vulnerable
   as well.

It is assumed, that other platforms (Google Android) are affected as well.


Vendor contact timeline:
------------------------
2024-01-24: Contacting vendor through support.us@...ame.tech; aftersales@...ame.tech
2024-02-05: Contacting vendor through support.us@...ame.tech; aftersales@...ame.tech
2024-02-06: Answer from vendor ticket system (#82462919) to contact marketing@...ame.tech
2024-02-06: Contacting vendor through marketing@...ame.tech, no response.
2024-02-12: Contacting vendor through marketing@...ame.tech, no response.
2024-03-04: Contacting vendor through marketing@...ame.tech, no response.
2024-04-11: Sending final email to support.us@...ame.tech; aftersales@...ame.tech
             and marketing@...ame.tech. Requesting security contact again. As they
             are unresponsive, setting release date to 18th April.
2024-04-11: Same ticket auto-response (#82521551) as from 2024-02-06:
               "Thank you for your great support and interest in our products!
                This is Dreame aftersales team; we are glad to be at your service.
                For your request, please kindly contact our marketing department
                (Email: marketing@...ame.tech) for direct assistance.

                Feel free to contact us with product related issues or concerns you
                may have."
2024-04-11: Sending them once again that marketing does not respond (and should not
             be responsible for security) and that we proceed to release the advisory
             on 2024-04-18.
2024-04-12: Vendor: "Thank you for reaching Dreame. We're sorry for the inconvenience.
                      According to our service policy, we have no access to confirm any
                      application for cooperation. We have already contacted our sales
                      team and IT support to further check your information. They will
                      reply to you if they decide to proceed cooperation with you.
                      Your kind understanding and patience are greatly appreciated."
2024-04-18: Public release of security advisory.


Solution:
---------
The vendor was unresponsive/uncooperative during multiple months of trying to
establish a security contact and to send them our findings. There is no patch/
solution available. Try to contact your local support team and request a patch
for this issue. Stay up-to-date with firmware and app installations and be vigilant.


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Alissa Kim / @2024
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists