Hard-Coded Credentials in Resamania QR Code Generator

Executive Summary

This vulnerability allows unauthorized generation of physical access QR codes due to hard-coded credentials in the application. The 'badge_number' parameter is used as an HMAC private key, which remains static and can be accessed via an API endpoint. Attackers can reverse engineer the APK to extract cryptographic logic and generate valid QR codes indefinitely.

Useful 0 Not Useful 0

Detection Guidance

Check for repeated or unusual QR code generation requests to the endpoint /club/_id_club_/member/_id_member_/resamania_qr_info. Monitor API logs for excessive access to this endpoint or unusual badge_number parameters. Reverse engineer the APK to inspect for hard-coded credentials or static HMAC keys.

Useful 0 Not Useful 0

Impact Analysis

An attacker could create fraudulent QR codes to gain unauthorized physical access to restricted areas. Even after password changes or logout, the static credentials allow continued exploitation. This could lead to physical breaches, theft, or unauthorized entry into secure locations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for physical security controls in GDPR (data protection) and HIPAA (healthcare data). Unauthorized access could lead to data breaches, non-compliance penalties, and loss of trust in security measures.

Useful 0 Not Useful 0

Mitigation Strategies

Rotate all hard-coded credentials and HMAC keys immediately. Update the application to use dynamic, user-specific keys for QR code generation. Implement code obfuscation to prevent reverse engineering of cryptographic logic. Restrict access to the QR code generation endpoint and monitor for unauthorized usage.

Useful 0 Not Useful 0