Mahavitaran Android Application: Insecure Communication of Sensitive Data

Vulnerable Software: Maharashtra State Electricity Board Android Application

Vulnerability: Insecure Communication of sensitive data

 

Affected Version: 7.50 and prior

 

Vendor Homepage: https://www.mahadiscom.in/en/home/

App store link: https://play.google.com/store/apps/details?id=com.msedcl.app&hl=en_IN&gl=US

 

CVE: 

 

CVE Author: Tejas Nitin Pingulkar

 

Exploit Available: POC Available

 

About Affected Software

 


The Official App for Consumer by Mahavitaran ( M.S.E.D.C.L.). Mahavitaran Consumer App enables consumers to avail Mahavitaran services at his/her fingertips. The app is simple and easy to use. It provides transparency in delivering services to consumers.

►Features :

*View and Pay bill
*Register and Track complaints
*View Bill and Payment history
*Manage Multiple Electricity Connections
*Contact 24 x7 MSEDCL Call Center
*Apply for New Connection
* Know the status of New Connection Application and Pay Estimate Charges
*Submit Meter Reading to avoid average billing
*Provide Feedback about Mahavitaran Services
*Update Contact Details ( Mobile Number & E-mail ID ) of consumer
*Find MSEDCL offices and collection centers near you
*Estimate your monthly electricity consumption and bill amount
*Get Information about the Feeder from where the power supply is provided to your connection
*Apply for the change of name
*Submit an application for addition/reduction in load

 

Exploit

Use any proxy software such as burp
login via app
intercept traffic
Observe that app sends username password as url parameter

 

Proof Of Concept

Mahavitaran Android Application: Insecure Communication of Sensitive Data

Leave a Reply

Your email address will not be published. Required fields are marked *

Scroll to top