Money Lover for Android & iOS leaked email addresses, transactions

guest · Feb 8, 2023

By Bill Toulas @billtoulas - February 8, 2023

A flaw in the Money Lover financial app for Android, iOS, and Windows allowed any logged-in member to see the email addresses and live transaction metadata for other users' shared wallets.
Click to expand...

Money Lover is a finance app allowing users to manage their expenses and budgets that has been downloaded five million times on the Play Store, with the app also available for iOS and Windows.

Money Lover allows users to create "shared wallets" with specific users, like family members or coworkers, to log transactions to collaborate in expense logging and monitoring.
Users invited to a shared wallet typically know each other, so sharing data and email addresses are expected.
Click to expand...

However, Trustwave's analyst and Money Lover user, Troy Driver, found that transaction data and email addresses associated with shared wallets are exposed to any authenticated users of the app.

"The shared wallet transactions disclose user information, such as the user's email address and shared wallet name," reads the Trustwave report.
"The email address and shared wallet name can be viewed via the Web Sockets tab of the browser's "Developer Tools." All Money Lover users who make use of the Shared Wallet feature are affected by this issue."
The analyst discovered the information disclosure flaw while examining the app's traffic using a proxy and the Web Sockets view in the browser's Developer Tools.
Click to expand...

Trustwave: Money Lover App Vulnerability Exposes Personal Info

By Troy Driver - February 7, 2023
An information disclosure vulnerability has been identified in Money Lover, a finance tracking application created by Finsify and available on Android, iOS, Microsoft Store, with a web interface. This vulnerability allows any authenticated user to view live transactions related to shared wallets. The information inadvertently disclosed by the app could allow a malicious actor to use the email addresses and metadata disclosed in this vulnerability, such as transaction IDs and wallet names, for further exploitation in case there are other vulnerabilities found within the application.
Click to expand...

Log in or Sign up

Money Lover for Android & iOS leaked email addresses, transactions

guest Guest

Log in or Sign up

Money Lover for Android & iOS leaked email addresses, transactions

guest Guest

Useful Searches