CVE-2020-26230 : What You Need to Know
Learn about CVE-2020-26230, a vulnerability in Radar COVID allowing the identification of COVID-19 positive users. Find out the impacted systems, exploitation risks, and mitigation steps.
Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and de-anonymization of COVID-19 positive users when using Radar COVID. The issue was fixed in iOS version 1.0.8, Android version 1.0.7, and Backend version 1.1.2-RELEASE.
Understanding CVE-2020-26230
This CVE highlights a vulnerability in Radar COVID that allows the identification and de-anonymization of COVID-19 positive users.
What is CVE-2020-26230?
The vulnerability in Radar COVID allows on-path observers to monitor traffic between the app and the server, potentially identifying users who had a positive COVID-19 test. This could lead to de-anonymization of users.
The Impact of CVE-2020-26230
- CVSS Score: 7.4 (High)
- Attack Vector: Adjacent Network
- Confidentiality Impact: High
- Scope: Changed
- No privileges required for exploitation
Technical Details of CVE-2020-26230
This section provides more technical insights into the vulnerability.
Vulnerability Description
The vulnerability allows for the identification and de-anonymization of COVID-19 positive users by monitoring traffic between the app and the server.
Affected Systems and Versions
- Radar-covid-backend-dp3t-server
- iOS version < 1.0.8
- Android version < 1.0.7
- Backend < 1.1.2-RELEASE
Exploitation Mechanism
The issue arises from the fact that only COVID-19 positive users make connections to the server, allowing observers to identify them.
Mitigation and Prevention
It is crucial to take immediate steps to address this vulnerability.
Immediate Steps to Take
- Update Radar COVID to the fixed versions: iOS 1.0.8, Android 1.0.7, Backend 1.1.2-RELEASE
- Avoid using public WiFi hotspots for sensitive activities
Long-Term Security Practices
- Use secure networks for sensitive transactions
- Regularly update the app and backend for security patches
Patching and Updates
Ensure all devices running Radar COVID are updated to the patched versions to prevent exploitation of this vulnerability.