Executive brief
DeviceFarmer stf is a platform for managing and controlling Android devices. The application uses DES-ECB, a cryptographically broken encryption algorithm, to secure VNC authentication credentials. An attacker could potentially decrypt sensitive authentication data or conduct pattern-analysis attacks, compromising access control to managed devices.
Technical details
The vulnerability is a use of broken cryptographic algorithm (CWE-327) where stf v3.6.6 employs DES-ECB encryption in the VNC authentication module (lib/util/vncauth.js). DES-ECB is inherently weak because it lacks an initialization vector and produces identical ciphertext for identical plaintext blocks, enabling pattern recognition attacks. No authentication or special network access is required to exploit this—an attacker with access to encrypted VNC credentials can apply well-known cryptanalysis techniques or brute-force attacks. The impact is compromise of VNC authentication confidentiality. A patch addressing this issue is expected in versions after 3.6.6.
Affected products
- DeviceFarmer stf 0 through 3.6.6
Timeline
- 2023-12-08: disclosed: Issue reported on GitHub
- 2024-01-29: advisory: GHSA and CVE published