CVE-2021-33840
📋 TL;DR
The Luca contact tracing app server (versions through 1.1.14) allows attackers to insert fake COVID-19 exposure records because phone number data lacks digital signatures. This affects all organizations using vulnerable Luca server instances for contact tracing.
💻 Affected Systems
- Luca contact tracing system
📦 What is this software?
Luca by Luca App
⚠️ Risk & Real-World Impact
Worst Case
Mass insertion of fake COVID-19 exposure records causing widespread panic, unnecessary quarantines, and overwhelming public health resources.
Likely Case
Targeted insertion of fake exposure records against specific individuals or organizations, causing unnecessary testing/quarantines and eroding trust in the contact tracing system.
If Mitigated
Limited impact with proper input validation and monitoring, though system integrity remains compromised.
🎯 Exploit Status
The vulnerability is well-documented in public issue trackers with technical details. Exploitation requires sending specially crafted registration data to the server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.15 and later
Vendor Advisory: https://luca-app.de/securityoverview/processes/guest_registration.html#verifying-the-contact-data
Restart Required: Yes
Instructions:
1. Update Luca server to version 1.1.15 or later. 2. Restart the server service. 3. Verify digital signatures are now required for phone number data.
🔧 Temporary Workarounds
Input validation and rate limiting
allImplement server-side validation of registration data and rate limiting on registration endpoints
# Configure rate limiting in web server (nginx example)
limit_req_zone $binary_remote_addr zone=registration:10m rate=10r/s;
# Add to location block for registration endpoints
limit_req zone=registration burst=20 nodelay;
🧯 If You Can't Patch
- Implement network-level filtering to block suspicious registration patterns
- Deploy additional monitoring on registration endpoints for anomalous activity
🔍 How to Verify
Check if Vulnerable:
Check if server version is 1.1.14 or earlier. Test by attempting to submit registration data without proper digital signatures.Check Version:
# Check Luca server version
curl -s http://[server-address]/api/version | grep versionVerify Fix Applied:
Verify server version is 1.1.15 or later. Test that registration requests without proper digital signatures are rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple registration attempts from same IP
- Registration requests with malformed or missing signature fields
- Unusual spike in guest registrations
Network Indicators:
- High volume of POST requests to registration endpoints
- Requests with manipulated phone number data
SIEM Query:
source="luca-server" AND (event="guest_registration" AND signature_status="invalid") OR (event="guest_registration" AND count > 10 per src_ip per hour)🔗 References
- https://gitlab.com/lucaapp/web/-/issues/1#note_560963608
- https://luca-app.de/securityoverview/processes/guest_registration.html#verifying-the-contact-data
- https://gitlab.com/lucaapp/web/-/issues/1#note_560963608
- https://luca-app.de/securityoverview/processes/guest_registration.html#verifying-the-contact-data
