Yorick Koster, April 2014 for Android fails to validate server certificates

Abstract for Android's WebView contains an insecure SSL error handler that ignores any certificate validation errors. Due to this, it is possible to perform a man in the middle attack against this app. The vulnerable component is used to log into A successful attack allows sniffing of login credentials (user name & password).

Tested versions

This issue was found in for Android version and version

See also

- CVE-2014-5239
- JVNDB-2014-000086 for Android contains an issue where it fails to verify SSL server certificates


A new version ( of for Android was released in which the affected SSL error handler is no longer present. The latest version of for Android can be obtained from Google Play


When logging into, for Android will load in a WebView. This WebView has implemented a custom SSL error handler, which basically ignores any certificate validation errors.

Insecure error handler

The affected SSL error handler can be found in the AuthorizationWebViewClient inner class of$OAuthDialog. The relevant code is listed below.

public void onReceivedSslError(WebView paramWebView, SslErrorHandler paramSslErrorHandler, SslError paramSslError)

As can be seen in this listing, the method gets an SslErrorHandler instance named paramSslErrorHandler. The handler calls proceed(), which will ignore any certificate error and the connection will be created. Due to this, any invalid certificate will also be accepted, even the attacker's certificate rendering the app vulnerable to man in the middle attacks. Since this issue exists within a login component, it is possible to steal Microsoft account login credentials, which is usually an email address and password.

Work with us →