Vulnerability in Apple Music for Android could be exploited to steal user data

Apple fixed a vulnerability tracked as CVE-2017-2387 in the Apple Music for Android that could allow attackers to launch MitM attacks on the application.

The update released Apple for the Apple Music application for Android fixes a certificate validation issue that can be exploited by an attacker to run MitM attacks and intercept user data.

The Apple Music for Android version 2.0 also implements new features and fixes the above vulnerability tracked as CVE-2017-2387.

According to Google Play, the version 2.0 of Apple Music for Android has between 10 and 50 million installs.

The flaw CVE-2017-2387 was discovered by David Coomber of Info-Sec.CA in August 2016. The vulnerability was affecting Apple Music 1.2.1 and earlier versions of the Android app.

“The Apple Music Android application (version 1.2.1 and below), does not validate the SSL certificates it receives when connecting to the mobile application login and payment servers.” reads the security advisory published by Coomber.

“An attacker who can perform a man in the middle attack may present bogus SSL certificates which the application will accept silently. Sensitive information could be captured by an attacker without the user’s knowledge.”

According to the expert, the app did not validate the SSL certificates presented while connecting to the login and payment servers. The attacker can present a forged SSL certificate that will be accepted by the application without raising any alert.

“An attacker who can perform a man in the middle attack may present bogus SSL certificates which the application will accept silently,” Coomber explained in his advisory. “Sensitive information could be captured by an attacker without the user’s knowledge.”

Unfortunately, such kind of issues is quite common for mobile applications and represent a serious threat to the user privacy.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – Apple Music for Android, mobile)