Description
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call the default-enabled endpoints to read SMS, call logs and contacts, send SMS, and export or overwrite configuration via the clone API.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
pppscn SmsForwarder
Default version status: unaffected
0 to ≤ 3.5.0affected
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/H1ue_ahiMe ↗
- https://github.com/pppscn/SmsForwarder/blob/v3.5.0/app/src/main/kotlin/cn/ppps/forwarder/utils/HttpServerUtils.kt#L35-L38 ↗
- https://github.com/pppscn/SmsForwarder/blob/v3.5.0/app/src/main/kotlin/cn/ppps/forwarder/server/component/AppMessageConverter.kt#L93-L96 ↗
- https://github.com/pppscn/SmsForwarder ↗
- https://www.vulncheck.com/advisories/smsforwarder-through-3.5.0-missing-authentication-in-http-server-remote-control-api ↗