CVE-2019-17355
📋 TL;DR
The Orbitz Android app version 19.31.1 stores authentication credentials in system logs during login, exposing usernames and passwords to attackers who can access logcat. This affects all users of the vulnerable Android application version. Attackers with physical access or malware on the device can extract credentials from logs.
💻 Affected Systems
- Orbitz - Flights, Hotels, Cars
📦 What is this software?
Orbitz by Orbitz
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full access to user accounts, leading to identity theft, financial fraud, unauthorized bookings, and exposure of personal information including payment details.
Likely Case
Local malware or users with physical access extract credentials from logs, compromising individual user accounts for unauthorized access or credential reuse attacks.
If Mitigated
With proper logging controls and credential masking, the exposure is limited to debug environments only, preventing production credential leakage.
🎯 Exploit Status
Exploitation requires access to device logs via ADB, malware, or physical access. No authentication bypass needed once logs are accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 19.31.1
Vendor Advisory: https://pastebin.com/GgpFz3ZW
Restart Required: Yes
Instructions:
1. Update Orbitz app via Google Play Store
2. Uninstall vulnerable version 19.31.1
3. Install latest version from official store
4. Restart device after installation
🔧 Temporary Workarounds
Disable Debug Logging
androidPrevent app from writing sensitive data to logs by disabling debug logging in production builds
adb shell setprop log.tag.Orbitz DEBUG
Modify app build.gradle: buildConfigField 'boolean', 'ENABLE_LOGGING', 'false'
Credential Masking
androidImplement credential masking in logging statements to prevent plaintext storage
Implement Log.d(TAG, "Auth attempt for: " + maskCredentials(username, password))
🧯 If You Can't Patch
- Uninstall vulnerable Orbitz app version 19.31.1 immediately
- Use web version of Orbitz instead of mobile app until patched
- Enable device encryption and strong authentication on Android device
- Monitor for suspicious account activity and change passwords regularly
🔍 How to Verify
Check if Vulnerable:
1. Install Orbitz 19.31.1 on Android device
2. Run: adb logcat | grep -i orbitz
3. Attempt login and check if credentials appear in logsCheck Version:
adb shell dumpsys package com.orbitz.android | grep versionNameVerify Fix Applied:
1. Update to latest Orbitz version
2. Repeat login process
3. Verify no credentials appear in adb logcat output📡 Detection & Monitoring
Log Indicators:
- Plaintext usernames/passwords in Android logcat
- Orbitz authentication logs containing credential patterns
Network Indicators:
- Unusual login locations/times for Orbitz accounts
- Multiple failed login attempts followed by success
SIEM Query:
source="android_logs" AND ("password" OR "username") AND "Orbitz"