CVE-2019-17397
📋 TL;DR
The DoorDash Android app versions through 11.5.2 store authentication credentials in application logs, allowing attackers with physical access or malware to extract usernames and passwords via logcat. This affects all Android users of the vulnerable DoorDash app versions.
💻 Affected Systems
- DoorDash
📦 What is this software?
Doordash by Doordash
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full access to user DoorDash accounts, enabling fraudulent orders, payment theft, and personal information exposure.
Likely Case
Malicious apps or users with physical device access extract credentials from logs, leading to account compromise and potential financial loss.
If Mitigated
With proper app sandboxing and log access restrictions, only privileged users or malware with specific permissions could access the credentials.
🎯 Exploit Status
Exploitation requires access to device logs via logcat, which can be achieved through malicious apps or physical access. The pastebin references demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 11.5.2
Vendor Advisory: Not publicly available
Restart Required: No
Instructions:
1. Update DoorDash app from Google Play Store to latest version. 2. Ensure auto-updates are enabled. 3. Verify app version is greater than 11.5.2.
🔧 Temporary Workarounds
Disable debug logging
androidPrevent credential logging by disabling debug features in app or system
adb shell setprop log.tag.DoorDash DEBUG
Disable USB debugging on device
Restrict log access
androidUse Android permissions to limit which apps can read system logs
Review app permissions and remove READ_LOGS from untrusted apps
🧯 If You Can't Patch
- Uninstall vulnerable DoorDash app version and use web interface instead
- Enable device encryption and strong lock screen to prevent physical access
🔍 How to Verify
Check if Vulnerable:
Install vulnerable version, authenticate, then run: adb logcat | grep -i doordashCheck Version:
Check app version in Android Settings > Apps > DoorDashVerify Fix Applied:
Update app, authenticate, check logs for credentials using same command - should show no credentials📡 Detection & Monitoring
Log Indicators:
- Log entries containing 'password', 'username', 'auth', 'login' from DoorDash process
Network Indicators:
- Unusual login locations or failed login attempts after credential exposure
SIEM Query:
process_name:"DoorDash" AND log_message:"password" OR log_message:"username"