La Nacion App WebSocket Credential Leak Vulnerability in Android

A vulnerability exists in La Nacion App version 10.2.25 for Android, specifically within the app.lanacion.activity component. The issue arises from a hardcoded WebSocket API key in the BuildConfig.java file. This vulnerability allows for the unprotected storage of credentials, as the API key can be extracted through reverse engineering. Once obtained, the key can be used to authenticate with the WebSocket endpoint, potentially leading to a distributed denial-of-service (DDoS) attack by establishing multiple concurrent connections and exhausting server resources.

Impact

Exploitation of this vulnerability allows for the extraction of a WebSocket API key, which can be used to authenticate with the WebSocket endpoint. This could enable an attacker to launch a distributed denial-of-service (DDoS) attack, exhausting server resources by establishing numerous concurrent connections from multiple sources.