Description
A vulnerability was found in GRID Organiser App up to 1.0.5 on Android. Impacted is an unknown function of the file file res/raw/app.json of the component co.gridapp.organiser. Performing a manipulation of the argument SegmentWriteKey results in use of hard-coded cryptographic key
. The attack is only possible with local access. The exploit has been made public and could be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GRID | Organiser App | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 | — |
References
- VDB-355042 | GRID Organiser App co.gridapp.organiser app.json hard-coded key vdb-entry technical-description
- VDB-355042 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #781759 | GRID GmbH GRID ORGANISER(co.gridapp.organiser) 1.0.5 Segment Write Key Exposure third-party-advisory
- https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-co-gridapp-org-3262de3f97fb801b9173c4851c7ad864?source=copy_link exploit