Description
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 1Byte | Copy9 | All | — |
| 1Byte | FoneTracker | All | — |
| 1Byte | iSpyoo | All | — |
| 1Byte | GuestSpy | All | — |
| 1Byte | TheSpyApp | All | — |
| 1Byte | ExactSpy | All | — |
| 1Byte | SecondClone | All | — |
| 1Byte | The Truth Spy | All | — |
| 1Byte | MxSpy | All | — |
References
- VU#229438 third-party-advisory
- https://cwe.mitre.org/data/definitions/284.html
- https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
- https://kb.cert.org/vuls/id/229438 third-party-advisory