Bharti Airtel Thanks App Cleartext Storage Vulnerability in Android

A vulnerability exists in the Bharti Airtel Thanks App for Android, specifically in version 4.105.4. The issue arises from an unknown function that leads to the cleartext storage of sensitive user data in files accessible on the device. This unencrypted information includes payment histories, personal details such as phone numbers and email addresses, and transaction IDs. The vulnerability can be exploited on physical devices, allowing for the extraction of this data through file management tools or ADB. The lack of encryption violates established mobile security guidelines, posing risks of identity theft and unauthorized access to financial information.

Impact

The vulnerability allows for the extraction of sensitive user data, including payment transaction logs, personal identification information, and authentication-related metadata, all stored in cleartext and unprotected.

Reproduction

To reproduce this vulnerability, install the Airtel Android app and perform payment or recharge activities. Then, navigate to the app's local storage directory at '/Android/data/com.myairtelapp/files/' using a file manager or ADB. Open the .txt or .xml files with a text editor to view the unencrypted payment history, phone number, and other sensitive information.

Remediation

It is recommended to store sensitive user data using AES-256 encryption, utilize the Android Keystore System for secure key management, and apply SQLCipher or encrypted SharedPreferences for data at rest. Additionally, implement secure data lifecycle management practices.