Android App SSL certificate validation weakness

Subject: Android App SSL certificate validation weakness

Title: Android App SSL certificate validation weakness
Advisory URL:

== Overview is an online betting web-site which also provides Android app. for the members to ease on betting.

We have found that Android app vulnerable to SSL mitm attacks ( which eventually let attackers to gather user name-password and session hijacking capabilities against app. users.

== Description

On misconfigured network environments it is possible to redirect HTTPS packets over MITM tools for SSL sessions.

When we redirected our network on such a configuration we have observed that app sends/receives user data unecrypted.


    "Password": "123456",
    "UserName": ""
And also Token value which is used for session awarenes is vulnerable for attackers to use on their own configurations to hijack other users' sessions.

== Affected Version(s)

No verison is given in app. But we provide md5 hash of the vulnerable APK

MD5 (birebin-android-latest.apk) = 60bea6a1694b1ffc87c4dc3f2ba6a8be

== Fixes
No known fixes has been released yet.

Copyright © 1995-2019 All rights reserved.