Vendor description
"We've emerged as one of the leading brands in smart home cleaning with our 4 major product lines: robotic vacuums and mops, cordless stick vacuums, wet and dry vacuums, and high-speed hair dryers. Each product is meticulously designed to redefine convenience in household innovation and improve our users' homes."
Source: https://www.dreametech.com/pages/about-us
Business recommendation
The vendor was unresponsive/uncooperative during multiple months of trying to establish a security contact and to send them our findings. There is no patch/solution available. Try to contact your local support team and request a patch for this issue. Stay up-to-date with firmware and app installations and be vigilant.
SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Broken authorization
An owner of the robot vacuum cleaner device can share it with other users via the app. The privileges of the shared users are very limited. It is not possible to interact with photos and videos from within the mobile application, but it was identified that it is possible to delete and list all images/videos of the main account and even download the encrypted images/videos by sending the requests with the JWT of the shared user. The encryption was not reverse-engineered but it could potentially be possible for unauthorized users to gain access to sensitive imaging data.
Proof of concept
1) Broken authorization
- To exploit the vulnerability it is sufficient to follow these steps:
- Connect a robot vacuum cleaner to the Dreamehome app (in our case the device "Dreame L10S ultra" was used).
- Take a photo and video with the Dreamehome app using the connected device.
- Share the robot vacuum cleaner with another user.
- The "shared user" can list the photos using the following curl command (It is necessary to set the "did" of the device):
[ POC removed]5. The "shared user" can list the videos using the following curl command:
[ POC removed]6. The response with the list of photos/videos contains an "id" parameter. Knowing this "id" parameter, a shared user can delete the photos/videos using the value of "id" in the "ossIds" parameter using the following command:
[ POC removed]7. Furthermore, the responses with the list of photos/videos contains a "filepath" parameter with the URL to the encrypted photo/video. Any user even without a valid JWT token can download the encrypted photo/video using this URL. The encryption was not reverse-engineered but it could potentially be possible for unauthorized users to gain access to sensitive imaging data.
Vulnerable / tested versions
The following versions have been tested which were the latest version available at the time of the test:
- Dreamehome app 2.1.0 (tested with Dreame L10S ultra device)
- Dreamehome app 2.1.5 was tested later on 2024-04-12 and found to be vulnerable as well.
It is assumed, that other platforms (Google Android) are affected as well.