CVE-2019-13143 Business logic in n/a
Attackers can hijack Bluetooth smart locks by exploiting HTTP parameter pollution to transfer ownership using trivially obtained identifiers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-13143?
CVE-2019-13143 is a critical vulnerability in n/a, published on 6 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the lock. The user ID, name, and MAC address are trivially obtained from APIs found within the Android or iOS application. With only the MAC address of the lock, any attacker can transfer ownership of the lock from the current user, over to the attacker's account. Thus rendering the lock completely inaccessible to the current user.
Weakness: CWE-20
Which versions are affected by CVE-2019-13143?
It affects 1 product.
Products include Shenzhen Dragon Brothers Fb50 Firmware.
How do I fix CVE-2019-13143?
No fix has been published for CVE-2019-13143 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13143 being exploited?
There is no known exploitation of CVE-2019-13143 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-43v9-p898-p49x.