The Vatican's official 'Click To Pray' app, promoted by Pope Francis himself, suffered from severe security vulnerabilities that exposed the personal information of over 700,000 users. A white-hat hacker, operating under the pseudonym BobDaHacker, detailed the extensive data leak in a blog post on July 24, noting that the issues persisted for months despite attempts to notify the relevant authorities.
The vulnerability allowed unauthorized access to user data by simply incrementing an ID number in the application's API. By visiting a specific URL and inputting a user ID, anyone could retrieve sensitive information including first name, last name, email address, country, date of birth, and account status. The app's backend was also noted to be running on a framework commonly learned in introductory Node.js courses, with the response headers revealing "X-Powered-By: Express."
Compounding the issue, the 'Click To Pray' app did not implement rate limiting, which would have made it trivial for malicious actors to scrape the data of all users. BobDaHacker highlighted that the app's user base, likely comprising individuals who are older, less tech-savvy, and deeply trusting of Vatican-associated services, represented a prime target for phishing attacks. The hacker suggested that fraudulent emails impersonating Vatican officials could easily trick users into divulging further information.
Further complicating matters, emails sent from the 'Click To Pray' app itself triggered authentication warnings, indicating that legitimate communications already bore the hallmarks of phishing attempts, potentially eroding user trust. Some users reported that emails from the app failed domain authentication requirements, making them appear suspicious.
BobDaHacker first discovered the vulnerability in early January and reportedly contacted nine different Vatican and 'Click To Pray' affiliated email addresses without receiving a response for seven months. The security flaws were only addressed after the hacker publicized their findings and contacted journalists. According to the hacker, the API endpoint for user data retrieval was quietly updated to include an authorization check, preventing access to other users' information. Upon testing the app after the fix, the received email did not trigger any alarm bells, suggesting the vulnerability has now been mitigated.