The Indian Computer Emergency Response Team (CERT-In) has identified several security issues in specific versions of the Tata Motors iRA 2.0 and iRA.ev connected vehicle applications.
These vulnerabilities could potentially allow attackers to extract sensitive credentials, access vehicle-related information and services, impersonate users, and modify application data without proper authorization.
In a vulnerability advisory released on Tuesday, CERT-In assigned a 'High' severity rating to these flaws. Affected versions include Tata Motors iRA 2.0 version 26.7.3 and earlier, as well as iRA.ev version 26.7.2 and earlier.
CERT-In strongly recommends that users update the affected applications to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to resolve the identified issues.
Four Vulnerabilities Discovered in Applications
CERT-In experts identified four types of vulnerabilities related to credential storage, web content verification, authentication token handling, and communication security between applications and backend services.
The first vulnerability involves hardcoded credentials within the applications. CERT-In explained this as 'the presence of hardcoded service account credentials, API keys, and authorization tokens inside the application package.' A remote attacker without authentication can download the application package and extract this information to gain access to corresponding backend services, which could lead to the disclosure of confidential information or unauthorized operations.
The second issue concerns insufficient validation of URLs and sources loaded via the WebView component in the applications. This was attributed to 'insufficient validation of URLs and sources loaded within the WebView component.' An attacker could inject malicious web content into the affected WebView, potentially obtain active authentication tokens, and impersonate users to access vehicle-related data and services.
The third vulnerability relates to authentication tokens being logged in application logs used for development and debugging. CERT-In pointed out that the cause is 'logging of authentication tokens in application logs used for development and debugging.' A local attacker with access to these logs could extract and use the exposed session tokens to impersonate users and gain unauthorized access to vehicle-related information and services.
The fourth vulnerability pertains to network security settings in the applications regarding SSL certificate pinning. CERT-In noted 'improper implementation of SSL certificate pinning in the network security configuration.' This could allow an attacker positioned to intercept network traffic to capture or alter communication between the applications and their backend services.
Applications Provide Access to Connected Vehicle Features
The iRA 2.0 and iRA.ev applications are designed for Internal Combustion Engine (ICE) and electric vehicles, respectively. These applications provide access to connected vehicle services, including remote commands to the vehicle, vehicle status, health monitoring, and trip information. The CERT-In assessment warns that successful exploitation of these vulnerabilities could allow attackers to access and modify data using the privileges of an impersonated user.
