CVE-2021-41719

Executive Summary

CVE-2021-41719 exposes a critical information disclosure vulnerability in the Maharashtra State Electricity Distribution Company Limited (Mahavitran) iOS application, version 16.1. The application transmits sensitive user credentials (account name and password) via the HTTP GET method. This practice embeds credentials directly into the URL query string, making them visible in browser history, server logs, referrer headers, and other network monitoring tools. The vulnerability is unpatched and has a public proof-of-concept, posing a high risk to user privacy and account security.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom iOS application developed by Maharashtra State Electricity Distribution Company Limited.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the GET request is standard.
• Privileges Required (PR): None – The attacker does not need prior authentication.
• User Interaction (UI): None – The victim does not need to perform any action beyond normal app usage.
• Scope (S): Unchanged – The vulnerable component is the application itself.
• Confidentiality (C): High – Credentials are fully exposed.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High. Credential exposure can lead to account takeover, unauthorized access to sensitive billing and personal data, and potential lateral movement within the utility's infrastructure.

Deep Dive & Mechanics

The vulnerability stems from a fundamental design flaw: the Mahavitran iOS application uses the HTTP GET method to transmit authentication credentials. In standard web application security, GET requests should never carry sensitive data because the parameters are appended to the URL.

Mechanism:

1. The user launches the Mahavitran app and enters their username and password.
2. The app constructs a URL like https://example.com/login?username=user123&password=pass456.
3. This URL is sent as an HTTP GET request to the server.
4. The server processes the request and returns a response.

Exposure Points:

• Browser History: If the app uses a WebView, the URL is stored in the browser history.
• Server Logs: The web server logs the full URL, including credentials.
• Referrer Headers: When the app navigates to other pages, the Referrer header may contain the full URL.
• Network Sniffing: Any intermediary (proxy, ISP, attacker on same network) can see the URL in plaintext.
• Caching: Proxies and browsers may cache the URL.

Root Cause: The developer chose GET over POST for login, likely due to simplicity or legacy design. This violates OWASP guidelines (e.g., A03:2021 – Injection, though here it's more about sensitive data exposure).

Vulnerable vs. Patched Code

Vulnerable Code (GET method):

// Vulnerable: Credentials in URL
let urlString = "https://api.mahavitran.in/login?username=\(username)&password=\(password)"
var request = URLRequest(url: URL(string: urlString)!)
request.httpMethod = "GET"
// Send request

Patched Code (POST method):

// Patched: Credentials in body
let urlString = "https://api.mahavitran.in/login"
var request = URLRequest(url: URL(string: urlString)!)
request.httpMethod = "POST"
let body = "username=\(username)&password=\(password)"
request.httpBody = body.data(using: .utf8)
request.setValue("application/x-www-form-urlencoded", forHTTPHeaderField: "Content-Type")
// Send request

The patched version moves credentials from the URL to the request body, preventing exposure in logs, history, and referrers. Additionally, HTTPS should be enforced to encrypt the body in transit.

Exploitation & Lab Setup

Red Team

Objective: Capture credentials from network traffic or logs.

Lab Setup:

1. Set up a Wi-Fi hotspot with a proxy (e.g., Burp Suite, mitmproxy).
2. Configure the victim device to use the proxy.
3. Launch the Mahavitran app and perform a login.
4. Observe the GET request in the proxy.

Exploit Steps:

1. Passive Sniffing: Use Wireshark on the same network to capture HTTP traffic.

   tshark -i eth0 -Y "http.request.method == GET and http.request.uri contains /login" -T fields -e http.request.uri
   

2. Active Interception: Use mitmproxy to intercept and log requests.

   mitmproxy --mode transparent --listen-port 8080
   

3. Log Analysis: If you have access to server logs, grep for login URLs.

   grep "GET /login" /var/log/apache2/access.log | grep -E "username=|password="
   

Expected Output:

GET /login?username=john_doe&password=MyP@ssw0rd! HTTP/1.1
Host: api.mahavitran.in

Blue Team

Detection:

• Monitor for GET requests to login endpoints containing username and password parameters.
• Alert on any HTTP GET request to /login or similar paths.

Hunting:

• Search web server logs for patterns like GET /login?username=.
• Use SIEM queries to find referrer headers containing login URLs.

Mitigation:

• Immediately update the app to use POST for login.
• Enforce HTTPS to encrypt all traffic.
• Implement input validation and output encoding.
• Rotate all user credentials that may have been exposed.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to */login?username=*&password=*
• Referrer headers containing username= and password=
• URLs with username and password parameters in plaintext

Log IOCs:

• Web server log entries with GET /login?username=...&password=...
• Proxy logs showing similar patterns

File IOCs:

• Browser history entries containing the login URL
• Cache files with the URL string

Sample IOC (URL):

https://api.mahavitran.in/login?username=testuser&password=Test123!

Detection Engineering

YARA Rule

rule CVE_2021_41719_Mahavitran_Credential_Exposure {
    meta:
        description = "Detects HTTP GET requests with credentials in URL for Mahavitran app"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-41719"
    strings:
        $s1 = "/login?username="
        $s2 = "&password="
        $s3 = "mahavitran" nocase
    condition:
        all of ($s1, $s2) or ($s1 and $s3)
}

Sigma Rule

title: Mahavitran App Credential Exposure via GET Request
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP GET requests containing credentials in the URL for the Mahavitran iOS app
author: Valters IT
date: 2025/04/10
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2021.41719
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - "/login?username="
            - "&password="
    condition: selection
falsepositives:
    - None expected
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-41719 Mahavitran App Credential Exposure via GET";
    flow:to_server;
    http.method; content:"GET";
    http.uri; content:"/login?username="; distance:0;
    http.uri; content:"&password="; distance:0;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the App: The vendor must release a patched version that uses POST for login.
2. Force HTTPS: Ensure all communication uses HTTPS to encrypt the body.
3. Credential Rotation: Force all users to change their passwords immediately.
4. Log Scrubbing: Review and sanitize server logs to remove exposed credentials.

Long-Term Fixes:

• Implement OAuth 2.0 or token-based authentication.
• Use secure coding practices (e.g., OWASP ASVS).
• Conduct regular security audits and penetration testing.
• Deploy a Web Application Firewall (WAF) to block GET requests to login endpoints.

Workarounds (if patch unavailable):

• Disable the app and use the web portal (if it uses POST).
• Use a VPN to encrypt traffic, though this does not fix the GET issue.
• Educate users to avoid using the app on untrusted networks.

Valters IT