CVE-2025-45081: ITIB SSO Android App ADB Backup Data Exposure

Key Information Vulnerability Details CVE ID: CVE-2025-45081 Status: PUBLISHED Link: https://nvd.nist.gov/vuln/detail/CVE-2025-45081 Description Issue: In the ITIB SSO Android App v1.1.0, the declaration of in the AndroidManifest.xml file allows unauthorized access to the application's internal storage via Android Debug Bridge (ADB), without requiring device root privileges. Attackers can extract sensitive data, including authentication tokens, user sessions, and profiles, by gaining physical access to the device and enabling USB debugging, leading to privacy violations and potential account compromise. Impact 1. Unauthorized access to user credentials and authentication tokens 2. Exposure of locally stored application data 3. Violation of institutional data protection guidelines 4. Increased risk of session hijacking and reverse engineering 5. Reduced application security Attack Scenario 1. Attacker gains physical access to the user's Android device 2. Enables USB debugging (if not already enabled) 3. Connects the device to a computer via USB 4. Executes ADB backup command: 5. Extracts sensitive application data (e.g., shared preferences, databases) from the .ab file 6. Analyzes plaintext content to retrieve session data and configuration details Affected Application App Name: ITIB SSO Package Name: in.ac.iitb.sso Version: 1.1.0 Play Store/Source: https://play.google.com/store/apps/details?id=in.ac.iitb.sso Vendor Information Vendor: Indian Institute of Technology Bombay Project: ITIB SSO Android App Website: https://www.iitb.ac.in/ Proof of Concept (PoC) 1. Enable USB debugging on the device 2. Connect the device to a computer via ADB 3. Run command: 4. Use a tool like Android Backup Extractor (ABE) to convert the .ab file to .tar 5. Inspect shared preferences, databases, and other extracted files 6. PoC Video: https://iDb.co/Z8in5jXK Severity Level Severity: High Discoverer Ishwar Kumar

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-45081: ITIB SSO Android App ADB Backup Data Exposure