Ossur Mobile Logic Application Exposure of Sensitive System Information to an Unauthorized Control Sphere
A valid set of credentials in a .js file and a static token for
communication were obtained from the decompiled IPA. An attacker could
use the information to disrupt normal use of the application by changing
the translation files and thus weaken the integrity of normal use.
Ossur Mobile Logic Application Exposure of Sensitive System Information to an Unauthorized Control Sphere
A valid set of credentials in a .js file and a static token for
communication were obtained from the decompiled IPA. An attacker could
use the information to disrupt normal use of the application by changing
the translation files and thus weaken the integrity of normal use.
Ossur recommends users download Version 1.5.5 or later of the mobile
application. The latest version of the application can be obtained
through the app store on respective mobile devices. No additional action
is required by users.
Configurations
Workarounds
Exploits
Credits
finder
Bryan Riggins reported these vulnerabilities to CISA.
A valid set of credentials in a .js file and a static token for
communication were obtained from the decompiled IPA. An attacker could
use the information to disrupt normal use of the application by changing
the translation files and thus weaken the integrity of normal use.