The Indian Computer Emergency Response Team (CERT-In) has flagged multiple security vulnerabilities in select versions of Tata Motors‘ iRA 2.0 and iRA.ev connected vehicle applications.
The vulnerabilities could allow attackers to extract sensitive credentials, access vehicle-related information and services, impersonate users and modify application data without authorisation.
In its vulnerability advisory, issued on Tuesday, CERT-In assigned a ‘High’ severity rating to the vulnerabilities. The affected versions are Tata Motors iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier.
CERT-In has advised users of the affected applications to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to address the vulnerabilities.
Four vulnerabilities identified in the applications
CERT-In has identified four vulnerabilities involving credential storage, validation of web content, handling of authentication tokens and security of communications between the applications and backend services.
The first vulnerability refers to hardcoded credentials in the applications. CERT-In attributed this to the “presence of hardcoded service account credentials, API Keys and authorization tokens within the application package”.
An unauthenticated remote attacker could download the application package and extract this information to gain access to associated backend services. This could also expose sensitive information or enable unauthorised operations.
The second vulnerability concerns inadequate validation of URLs and origins loaded through the applications’ WebView component. CERT-In identified “insufficient validation of URLs and origins loaded within the WebView component” as the cause for this.
An attacker could send malicious web content to the affected WebView, potentially obtain live bearer authentication tokens and impersonate users to access vehicle-related information and services.
The third vulnerability involves authentication tokens being recorded in application logs used for development and debugging. CERT-In attributed this to the “recording of authentication tokens in application logs used for development and debugging”.
A local attacker with access to these logs could retrieve and misuse exposed session tokens to impersonate users and gain unauthorised access to vehicle-related information and services.
The fourth vulnerability relates to SSL certificate pinning in the applications’ network security configuration. CERT-In identified an “improper implementation of SSL certificate pinning in the network security configuration”.
This could allow an attacker positioned to intercept network traffic to intercept or modify communications between the applications and their backend services.
Applications provide access to connected vehicle features
Tata Motors’ iRA 2.0 and iRA.ev applications cater to customers of its internal combustion engine (ICE) and electric vehicles, respectively.
The applications provide access to connected vehicle services, including remote vehicle commands, vehicle status, health monitoring and trip information. CERT-In’s assessment warns that successful exploitation could allow attackers to access and modify data using the privileges of an impersonated user.