Task #13211
Task #13202: Huawei Pentest Remidiation
HUAWEI - L7 - Private IP Addresses Disclosed (Unintended Data Leakage)
| Status: | Closed - End of life cycle | Start date: | September 06, 2022 | |
|---|---|---|---|---|
| Priority: | Normal | Due date: | September 12, 2022 | |
| Assignee: |  MUHAMMAD IHSAN | % Done: | 100% | |
| Category: | PCI DSS - Pentest | Spent time: | - | |
| Target version: | - |
Description
Description :
LGMS security team identified private IP addresses stored within the mobile application installer package.
RFC 1918 specifies ranges of IP addresses that are reserved for use in private networks and cannot be routed on the public Internet. Although various methods exist by which an attacker can determine the public IP addresses in use by an organization, the private addresses used internally cannot usually be determined in the same ways.
Discovering the private addresses used within an organization can help an attacker in carrying out network-layer attacks aiming to penetrate the organization's internal infrastructure.
LGMS Solution :
There is not usually any good reason to disclose the internal IP addresses used within an organization's infrastructure. Remove these IP addresses from the mobile application installer package before releasing it to the general public.
Penril Plan :
To update following android fixes .
History
#1
Updated by MUHAMMAD IHSAN about 2 years ago
- File Screenshot 2022-09-12 152052.png added
- Status changed from New - Begin Life Cycle to Finished Development
- Assignee changed from Rahmat Aina Nadia to MUHAMMAD IHSAN
- % Done changed from 0 to 100
The IP addresses will be removed before release.
#2
Updated by Binti Marobi Athirah Umairah over 1 year ago
- Status changed from Finished Development to Closed - End of life cycle
Deployed to SIT on 15/4/22
Deployed to UAT on 18/4/22
Confirmed by azyan on 23/3/23, now pending LGMS feedback and new testing cycle result.