CVE-2025-47147

SHADOW_DORKS: ["Gallagher Command Centre Mobile Client", "CVE-2025-47147"]

Executive Summary

CVE-2025-47147 is a vulnerability in Gallagher Command Centre Mobile Client for Android and iOS that exposes session tokens in cleartext storage. An attacker with physical or remote access to a logged-in operator’s mobile device can extract the session token and reuse it for a limited duration, bypassing authentication controls. The vulnerability is classified as CWE-312 (Cleartext Storage of Sensitive Information) with a CVSS score of 5.7 (Medium). No public exploit code or proof-of-concept is currently available, and the vendor has released a patch in version 9.40.123.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary mobile application (Gallagher Command Centre Mobile Client) distributed through official app stores. The risk is limited to the application’s local storage handling on the device.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Physical (AV:P) – Requires physical access to the mobile device.
• Attack Complexity (AC): Low (AC:L) – No special conditions needed.
• Privileges Required (PR): None (PR:N) – Attacker does not need prior access.
• User Interaction (UI): Required (UI:R) – Operator must be logged in.
• Scope (S): Unchanged (S:U) – Exploit stays within the vulnerable component.
• Confidentiality Impact (C): High (C:H) – Session token can be used to access sensitive data.
• Integrity Impact (I): Low (I:L) – Limited ability to modify data.
• Availability Impact (A): None (A:N) – No denial of service.

Threat Level: Medium. Exploitation requires physical access, but the impact on confidentiality is high.

Deep Dive & Mechanics

The vulnerability stems from the Command Centre Mobile Client storing session tokens in cleartext within the application’s local storage (e.g., SharedPreferences on Android, UserDefaults on iOS). When an operator authenticates, the server issues a session token that is cached locally without encryption. An attacker who gains access to the device (e.g., via theft, malware, or physical proximity) can extract this token from the file system.

The token remains valid for a limited duration (typically until the session expires or the operator logs out). During this window, the attacker can impersonate the operator by presenting the stolen token to the Command Centre server, gaining unauthorized access to surveillance feeds, alarm data, and system configurations.

The root cause is a failure to apply platform-native secure storage APIs (e.g., Android Keystore, iOS Keychain) for sensitive data. The fix in version 9.40.123 likely encrypts the token before storage or uses secure enclave features.

Vulnerable vs. Patched Code

Vulnerable (pre-9.40.123):

// Android example – storing token in cleartext
SharedPreferences prefs = getSharedPreferences("session", MODE_PRIVATE);
prefs.edit().putString("token", sessionToken).apply();

Patched (9.40.123+):

// Android example – using EncryptedSharedPreferences
MasterKey masterKey = new MasterKey.Builder(context)
        .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
        .build();
SharedPreferences prefs = EncryptedSharedPreferences.create(
        context, "session", masterKey,
        EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
        EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
);
prefs.edit().putString("token", sessionToken).apply();

On iOS, the fix likely replaces UserDefaults with the Keychain API:

// Vulnerable
UserDefaults.standard.set(sessionToken, forKey: "token")

// Patched
let query: [String: Any] = [
    kSecClass as String: kSecClassGenericPassword,
    kSecAttrAccount as String: "token",
    kSecValueData as String: sessionToken.data(using: .utf8)!
]
SecItemAdd(query as CFDictionary, nil)

Exploitation & Lab Setup

Red Team

1. Prerequisites: Physical access to a mobile device with Command Centre Mobile Client installed and an active session.
2. Extract Token (Android):
   • Enable USB debugging on the device.
   • Use adb shell to navigate to /data/data/com.gallagher.commandcentre/shared_prefs/.
   • Pull the session XML file: adb pull /data/data/com.gallagher.commandcentre/shared_prefs/session.xml.
   • Parse the file to retrieve the cleartext token.
3. Extract Token (iOS):
   • Jailbreak the device or use a forensic tool (e.g., Cellebrite).
   • Access the app’s sandbox at /var/mobile/Containers/Data/Application/<UUID>/Library/Preferences/.
   • Read the plist file containing the token.
4. Reuse Token:
   • Use a tool like curl or Postman to send a request to the Command Centre server with the stolen token in the Authorization header:

     curl -H "Authorization: Bearer <stolen_token>" https://commandcentre.example.com/api/sessions
     

   • If the token is still valid, the server returns session data.

Blue Team

1. Detection: Monitor for anomalous API calls from IP addresses not associated with known operators.
2. Prevention: Enforce device encryption and screen lock policies via MDM.
3. Response: Immediately revoke all sessions for the affected operator account upon token theft detection.

Indicators of Compromise (IOCs)

• File Artifacts:
  • Android: /data/data/com.gallagher.commandcentre/shared_prefs/session.xml containing cleartext token.
  • iOS: /var/mobile/Containers/Data/Application/<UUID>/Library/Preferences/com.gallagher.commandcentre.plist with cleartext token.
• Network Traffic: HTTP requests with Authorization: Bearer <token> from unexpected IPs.
• Process: Unauthorized adb connections to the device.

Detection Engineering

YARA Rule

rule CVE_2025_47147_SessionToken {
    meta:
        description = "Detects cleartext session token storage in Gallagher Command Centre Mobile Client"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-47147"
    strings:
        $token = /[A-Za-z0-9\-_]{20,}/  // Generic token pattern
        $app_id = "com.gallagher.commandcentre"
    condition:
        $app_id and $token
}

Sigma Rule

title: Gallagher Command Centre Session Token Extraction
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to extract session tokens from Gallagher Command Centre Mobile Client
author: Valters IT
logsource:
    product: android
    service: adb
detection:
    selection:
        EventID: 1001  # ADB connection event
        Command|contains: "pull /data/data/com.gallagher.commandcentre/shared_prefs/"
    condition: selection
falsepositives:
    - Legitimate debugging by developers
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-47147 - Stolen Session Token Usage"; flow:to_server,established; content:"Authorization|3a| Bearer "; http_header; pcre:"/Bearer [A-Za-z0-9\-_]{20,}/"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Command Centre Mobile Client version 9.40.123 or later.
2. Compensating Controls:
   • Enforce device encryption (Android: full-disk encryption; iOS: Data Protection).
   • Require biometric or PIN authentication to open the app.
   • Implement short session timeouts (e.g., 5 minutes of inactivity).
   • Use MDM to restrict USB debugging and app sideloading.
3. Long-term: Conduct code review to ensure all sensitive data uses platform-native secure storage (Android Keystore, iOS Keychain).

Valters IT
DevSecOps & Cyber Threat Intelligence