VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure

Summary

VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embedded WeChat, Tencent QQ, and Fitbit credentials from the decompiled application to abuse the active third-party application registrations.

Remediation

1. Inventory every Shenzhen Shine Industrial Co., Ltd. VitaFit deployment, including staging.
2. Upgrade Shenzhen Shine Industrial Co., Ltd. VitaFit to 2.8.1.0.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://www.vulncheck.com/advisories/vitafit-android-hardcoded-credentials-disclosure
• Referencehttps://github.com/je-lv/vitafit-security-research
• Referencehttps://play.google.com/store/apps/details?id=com.vt.vitafit