CVE-2025-56608
📋 TL;DR
This vulnerability allows attackers to potentially bypass authentication in the Corona Virus Tracker App India by exploiting weak MD5 hashing. Attackers could perform replay attacks, credential spoofing, or brute-force attacks to gain unauthorized access. Only users of this specific Android application version are affected.
💻 Affected Systems
- Corona Virus Tracker App India
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to sensitive COVID-19 tracking data and user information.
Likely Case
Credential theft through hash collision attacks leading to account compromise.
If Mitigated
Limited impact with proper network controls and monitoring in place.
🎯 Exploit Status
Exploitation requires intercepting authentication traffic and performing hash collision attacks against MD5.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in references, but vendor should release updated version
Vendor Advisory: https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html
Restart Required: No
Instructions:
1. Contact vendor for updated version. 2. Replace MD5 with SHA-256 or stronger algorithm in OkHttpClientWrapper.java. 3. Recompile and distribute updated APK.
🔧 Temporary Workarounds
Network Traffic Encryption
allEnforce TLS 1.2+ for all app communications to prevent credential interception
🧯 If You Can't Patch
- Monitor network traffic for unusual authentication patterns
- Implement rate limiting on authentication endpoints
🔍 How to Verify
Check if Vulnerable:
Decompile APK and search for 'MessageDigest.getInstance("MD5")' in OkHttpClientWrapper.javaCheck Version:
Check app version in Android Settings > Apps > Corona Virus Tracker App IndiaVerify Fix Applied:
Verify updated APK uses SHA-256 or stronger algorithm in authentication code📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same source
- Successful logins with unusual timing patterns
Network Indicators:
- Repeated authentication requests with same hash values
- Unencrypted authentication traffic
SIEM Query:
source="app_server" AND (event="authentication_failure" count>10 within 5min OR event="authentication_success" from new_device)🔗 References
- https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4
- https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md
- https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html
