Logical Bug in Message Delete Functionality in Zoho (Cliq Application) that leads to Deleted message seen to user.

As you know that every chat application send push notification to user’s device when a message arrive.

Push Notification:

Push notification is a message pushed from a software application to the user’s device.

Push notification originates from the server and they only reach users who have installed the application. Push notifications are messages that pops up on a user's mobile device in a heads-up manner are called push notifications. Push notifications help in delivering timely & relevant information to users even if the user is not active on the website or app

DESCRIPTION :

Most of the chat application have chat delete functionality, in which a user can delete the message for everyone. In this case, message are no longer for both user. But due to some loop holes in message deletion functionality like Message still shown on push notification after deleting the message from application.

PROCEDURE:

1. Send message from one cliq user for example Amit to another user patil

2. Patil got a notification on his phone.

3. Then Amit delete the message for everyone .According to delete feature message should be deleted from both side.

4. But on patil phone Message still shown on Push notification.

Mitigation:

Message should be deleted from push notification when user delete message for everyone,

VIDEO POC ATTACHED BELOW:

Timeline:

Mar 26, 2020 - Bug Reported to ZOHO

Mar 28, 2020 - Status changes to Triaged

Mar 30, 2020 - Nice Catch! From ZOHO❤

Apr 10, 2020- Bounty Awarded $$$ +Hof

Comments

Passcode Protection Bypass By Brute Forcing On zoho (Cliq Application)

First We discuss about what is passcode and Why it is Implemented in Mobile Applications. PASSCODE Implemented in Mobile Application to protect Applications from an Unauthorized Access.like for example your cliq or any application account is logged in mobile phone .any your friend ask you to give phone , your friend try to open cliq application to see your message, but your friend cant open the application without entering passcode . he have to enter passcode for open, so it is an extra layer security in applications. Passcode protection implemented in Android Application is an extra layer security to protect an unauthorized access. How Passcode Protection is bypassed by Bruteforcing? You know that passcode protection or pin protection in mobile applications have some attempt to enter passcode , if you enter wrong passcode more than 5 times or 10 times based on application security , User logged out automatically and redirected to login page.but due to some ...

Exploitation of Improper Export of Activities In Android Application

In android You know that every GUI interface is an separate activity. An activity represents a single screen with a user interface just like window or frame of Java. In An application there are many activities depend on application functionalities. Let's take a example : An application that have three modules login , register and dashboard . For that there are there are three different activities for all these modules. What is export Means Here? In Android Application there is an attribute android: exported =true or false . This attribute is used in android to provide an access to other third party application to start their service , activities and receive broadcast messages. Like for an Example : If an application have broadcast receiver to receive any events or message , if in that application exported attribute is set to true then this broadcast message can also receive by other thi...

A New Way Of Brute force Passcode/Pin Protection By deep link

DESCRIPTION : AS you know already that what is passcode protection and why it is applied ? And how it is bypassed normally ? If you don’t know please read my previous blog: https://negativewives.blogspot.com/2020/04/passcode-protection-bypass-by-brute.html When any passcode protection is implemented first check any activity is exported or not ? Here we only talking the scenario where no activity is exported in application PROCEDURE : Open Application after implementing passcode protection. You see that passcode activity is launched first Go to AndroidMainfest.xml file and check launch mode of passcode activity . Question Arises in your mind - ...

NegativeWibes

Search This Blog