Hard-Coded MQTT Credentials in AM CLUB Mobile App

Executive Summary

This vulnerability involves hard-coded MQTT credentials in the AM CLUB mobile app. These static credentials allow unauthorized users to connect to the MQTT broker used for vending machine communication. The issue arises because the credentials are embedded in the app's code and can be extracted without authentication.

Useful 0 Not Useful 0

Detection Guidance

Check for hard-coded MQTT credentials in the AM Club mobile application's APK by inspecting JavaScript code or decompiled files. Use tools like apktool to extract the APK and search for MQTT username/password strings. Monitor network traffic for unauthorized MQTT connections using commands like tcpdump or Wireshark to detect unexpected broker access.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access data or perform actions across tenant boundaries by connecting to the MQTT broker. This requires access to the affected APK and network connectivity to the broker. The impact depends on the broker's access-control policies.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability may violate compliance with GDPR and HIPAA due to unauthorized access to sensitive data via hard-coded MQTT credentials. GDPR requires protecting personal data, and HIPAA mandates safeguarding health-related information. Unauthorized broker access could lead to data breaches, violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the AM Club application to version 1.7.197 or later, where hard-coded credentials have been removed. Verify if old credentials were revoked and ensure the MQTT broker enforces strict access controls. Restrict broker access to trusted IPs and implement topic-level authorization to prevent unauthorized data access.

Useful 0 Not Useful 0