CVE-2014-5625

Vulnerability

Perfect Kick (com.gamegou.PerfectKick.google) version 1.3.0 for Android does not verify X.509 certificates presented by HTTPS servers. This means the app accepts any certificate, including those from untrusted or malicious sources, without validating the chain of trust. The issue affects all installations of version 1.3.0.

Exploitation

An attacker on the same network as the victim (e.g., public Wi-Fi) can perform a man-in-the-middle attack by presenting a crafted certificate. No user interaction beyond normal app usage is required; the app will connect to the attacker's server as if it were legitimate.

Impact

Successful exploitation allows the attacker to decrypt, read, and modify HTTPS traffic between the app and its backend. Sensitive information transmitted by the app, such as login credentials or personal data, can be stolen. In some cases, arbitrary code execution may be possible depending on how the app processes network data [1].

Mitigation

The vendor has not released a patched version. Users should uninstall the application and avoid using it until an update is provided. As of the note's last revision (2016-11-08), no fix was available [1].