Vulnerabilities in platform fitness app management could allow hackers to compromise user accounts on dozens of such apps, even if two-factor authentication (2FA) is enabled.
The fitness app management platform is Fizikal, based in Israel, and allows customers to manage subscriptions to apps and gyms.
Many vulnerabilities affecting the Fizikal platform could be used to checks security, enumerate users, perform bruteforce attacks, and gain access to a user's account.
Brute-force attacks
Sahar Avitan , a consultant at Israel-based cybersecurity firm Security Joes , discovered that around 80 apps rely on Fizikal's API to provide easier access to sports clubs and available amenities.
There are about 70 Fizikal apps in the “Health & Fitness” category of the Google Play Store, many of which were added in the last few days. Some of the older apps have over 5,000 downloads and together have been installed on at least 240,000 devices.
Avitan began analyzing the fitness app management platform after resetting the password for his EZ Shape account , a fitness app he used. That's when he noticed he was given a weak 4-character password.
The researcher observed that the password reset process had different results for phone numbers that exist in the database compared to those that do not.
This allowed him to better understand the entire mechanism that allows bypassing security checks and enumerating users. This information allowed him to learn the phone numbers that users had set to receive the OTP password via SMS when they confirm the reset.
Additionally, another bug in the fitness app management platform made it possible to brute force OTP numbers (the process takes about a minute) and send them to the Fizikal API, before the legitimate user received the notification.
According to Security Joes, the OTP verification process was not protected by any anti-automation mechanism or captcha that would prevent brute-force attack attempts.
Avitan sent the OTP code to the fitness app management platform server and received a unique TokenID, necessary to generate a new password. He then sent the code to the server in HTTP headers along with a new password.
Compromising an account on some of apps not only allows an attacker to lock out the legitimate user or cancel their subscription, but also grants them access to personal user information:
- Phone number
- Full name
- Date of birth
- Email address
- Mailing address
- Identity number
Ido Naor, founder and CEO of Security Joes, said a malicious hacker could exploit these vulnerabilities to obtain other users' information.
According to the researchers, Fizikal and the CERT in Israel received a full report on the findings and acted quickly to address the issues.
