Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] user credentials could be easily retrieved #29

Open
knacky34 opened this issue Jul 13, 2023 · 0 comments
Open

[Security] user credentials could be easily retrieved #29

knacky34 opened this issue Jul 13, 2023 · 0 comments

Comments

@knacky34
Copy link

knacky34 commented Jul 13, 2023

Describe the bug
The user login is transmitted via unsecured HTTP to tv.deezer.com.
So plain text email address and a MD5 hash of the password are transmitted.
However MD5 is not a strong hash function as it could be easily reversed.

Environment (optional if log file provided) :

  • affected OS: any
  • affected addon version: 2.0.5

Steps to reproduce

  1. Open Wireshark (or any packet interception app) and start capture
  2. Open Kodi and try authenticate to Deezer
  3. You should be able to view the corresponding packet in Wireshark with endpoint : http://tv.deezer.com/smarttv/authentication.php
  4. Now you have access to the user email its hashed password

Packet in Wireshark

How to resolve
Please consider using HTTPS and if possible SHA256 hash.
You might also enable HTTPS for the streaming.php endpoint.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant