CERT-In Flags High-Severity Vulnerabilities in Tata Motors' iRA Apps

The Indian Computer Emergency Response Team (CERT-In) has identified multiple high-severity security vulnerabilities in select versions of Tata Motors' iRA 2.0 and iRA.ev connected vehicle applications. These flaws could allow attackers to extract sensitive credentials, access vehicle-related information, impersonate users, and modify application data without authorization, as detailed in CERT-In's advisory issued on Tuesday.

Specifically, the affected versions include Tata Motors iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier. CERT-In has advised users of these applications to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to address the identified vulnerabilities. Four distinct security issues were pinpointed.

One vulnerability involves hardcoded credentials, including service account credentials, API Keys, and authorization tokens, present within the application package. An unauthenticated remote attacker could download this package, extract the information, and gain access to associated backend services, potentially exposing sensitive data or enabling unauthorized operations. Another issue concerns insufficient validation of URLs loaded within the applications' WebView component, which could allow an attacker to send malicious web content, obtain live bearer authentication tokens, and impersonate users to access vehicle data.

A third vulnerability relates to authentication tokens being recorded in application logs used for development and debugging, making them retrievable by a local attacker to misuse exposed session tokens for impersonation. The fourth flaw is an improper implementation of SSL certificate pinning in the network security configuration, potentially enabling an attacker to intercept or modify communications between the applications and their backend services. Tata Motors' iRA applications provide connected vehicle services such as remote commands, status monitoring, and trip information for both ICE and electric vehicles. Successful exploitation could lead to data access and modification using impersonated user privileges.

What to watch: Users should promptly update their applications to the recommended versions.

Editor's note: Accurate and detailed reporting that captures all technical vulnerabilities and context provided in the source text.