Unauthenticated Remote API Access in SmsForwarder

SmsForwarder through version 3.5.0 is vulnerable to a missing authentication flaw within its embedded AndServer HTTP server component. This vulnerability allows an unauthenticated network-adjacent attacker to reach sensitive remote-control API endpoints that are enabled by default. By communicating directly with the application over the network, an attacker can perform high-impact actions, including reading SMS messages, accessing call logs, extracting contact information, and sending arbitrary SMS messages. Furthermore, the vulnerability exposes a 'clone' API that enables attackers to export or overwrite the application configuration. This impact is significant for environments where SmsForwarder is used to bridge messaging services or automate communication, as the exposed functionality effectively grants an attacker full control over the mobile device's communication capabilities.

Impact

The vulnerability poses a severe risk of data exfiltration and unauthorized command execution for users of SmsForwarder. Attackers can monitor private communications, spoof legitimate messages, and gain persistence or modify the application behavior by overwriting configurations. This is particularly dangerous for enterprise users relying on the software for secure SMS forwarding or secondary authentication channels, where interception or manipulation could lead to account takeovers or sensitive data leaks.

Recommendation

• Upgrade SmsForwarder to a version beyond 3.5.0 immediately to address the insecure AndServer implementation.
• Restrict network access to the mobile device running SmsForwarder, ensuring that the port used by the AndServer component is not exposed to untrusted or public networks.
• Audit mobile device firewall settings and application permissions to identify and isolate instances of SmsForwarder exposed to network segments accessible by unauthorized third parties.