CVE-2020-12717 PoC — COVIDSafe app 输入验证错误漏洞

Source

https://github.com/wabzqem/covidsafe-CVE-2020-12717-exploit

Associated Vulnerability

Title:COVIDSafe app 输入验证错误漏洞 (CVE-2020-12717)
Description:The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected.

Description

Code for exploit for CVE-2020-12717

Readme

# What

This is the code for the demonstration of the COVIDSafe exploit in
[![](http://img.youtube.com/vi/7UdVHB1ohNo/0.jpg)](http://www.youtube.com/watch?v=7UdVHB1ohNo "")

See https://medium.com/@wabz/covidsafe-ios-vulnerability-cve-2020-12717-30dc003f9708 for more information


## Server
This has to be run on linux. It uses @abandonware/bleno nodejs module (you need nodejs10), which trivially allows setting advertising bytes for the gatt server.

I run this on Linux Mint, in VirtualBox, adding a USB Bluetooth adapter to pass through. Install the requirements as per bleno's intructions, they are still current.

It runs an express server, with a very simple interface:

`http://0.0.0.0:3000/start` - starts advertising with exploit advertisement

`http://0.0.0.0:3000/stop` - stops advertising

## Client

A super simple Material Angular application. If you set up a Host-only Adapter for VirtualBox, you can connect to the server in the VM. Simply toggle to hit the APIs. See the site/README.md for details on how to run it.

File Snapshot


 [4.0K]  /data/pocs/b0e76b3cb49b4157a5ff5943c8040584d9964712
├── [1.0K]  README.md
├── [4.0K]  server
│   ├── [3.8K]  index.js
│   └── [ 58K]  package-lock.json
└── [4.0K]  site
    ├── [3.7K]  angular.json
    ├── [ 429]  browserslist
    ├── [4.0K]  e2e
    │   ├── [ 808]  protractor.conf.js
    │   ├── [4.0K]  src
    │   │   ├── [ 637]  app.e2e-spec.ts
    │   │   └── [ 301]  app.po.ts
    │   └── [ 214]  tsconfig.json
    ├── [1016]  karma.conf.js
    ├── [1.4K]  package.json
    ├── [492K]  package-lock.json
    ├── [1021]  README.md
    ├── [4.0K]  src
    │   ├── [4.0K]  app
    │   │   ├── [   0]  app.component.css
    │   │   ├── [ 570]  app.component.html
    │   │   ├── [ 936]  app.component.spec.ts
    │   │   ├── [ 743]  app.component.ts
    │   │   └── [ 831]  app.module.ts
    │   ├── [4.0K]  assets
    │   ├── [4.0K]  environments
    │   │   ├── [  51]  environment.prod.ts
    │   │   └── [ 662]  environment.ts
    │   ├── [ 948]  favicon.ico
    │   ├── [ 536]  index.html
    │   ├── [ 372]  main.ts
    │   ├── [2.8K]  polyfills.ts
    │   ├── [ 180]  styles.css
    │   └── [ 753]  test.ts
    ├── [ 210]  tsconfig.app.json
    ├── [ 489]  tsconfig.json
    ├── [ 270]  tsconfig.spec.json
    └── [3.1K]  tslint.json

8 directories, 30 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!