A flaw in the Money Lover financial app for Android, iOS, and Windows allowed any logged-in member to see the email addresses and live transaction metadata for other users’ shared wallets.
Money Lover is a finance app allowing users to manage their expenses and budgets that has been downloaded five million times on the Play Store, with the app also available for iOS and Windows.
Money Lover allows users to create “shared wallets” with specific users, like family members or coworkers, to log transactions to collaborate in expense logging and monitoring.
Users invited to a shared wallet typically know each other, so sharing data and email addresses are expected.
However, Trustwave’s analyst and Money Lover user, Troy Driver, found that transaction data and email addresses associated with shared wallets are exposed to any authenticated users of the app.
“The shared wallet transactions disclose user information, such as the user’s email address and shared wallet name,” reads the Trustwave report.
“The email address and shared wallet name can be viewed via the Web Sockets tab of the browser’s “Developer Tools.” All Money Lover users who make use of the Shared Wallet feature are affected by this issue.”
The analyst discovered the information disclosure flaw while examining the app’s traffic using a proxy and the Web Sockets view in the browser’s Developer Tools.
The exposed data included email addresses, wallet names, and limited transaction data.
The analyst thought these might have been the emails of the developers of a JavaScript library. However, when the list got quickly populated with more addresses, it became clear that the app’s server was leaking sensitive information.
Trustwave reported the issue to the publisher of Money Lover, Finsify, who released a fixing update on January 27, 2023.
The report did not clarify when the flaw was discovered or how long Money Lover users remained exposed.
It is essential to clarify that the information disclosure bug only impacted users who used the shared wallet feature.
The main repercussion of this flaw is that an attacker accessing email addresses and transaction metadata could perform targeted phishing attacks against the exposed users to gain access to further sensitive information.
Money Lover users are recommended to update their app to the latest available version using their operating system’s app store.