CVE-2017-16905
Description
The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"The app loads its initial WebView content over unencrypted HTTP instead of HTTPS, allowing a man-in-the-middle attacker to inject arbitrary content."
Attack vector
An attacker on the same network performs a man-in-the-middle attack by spoofing DNS responses so that tinycards.duolingo.com resolves to the attacker's machine. When the TinyCards app starts, it makes an unencrypted HTTP request to that domain; the attacker intercepts the request and serves arbitrary HTML/JavaScript content instead of the legitimate page. Because the app is a thin WebView wrapper around a remote web application, the injected JavaScript executes within the WebView, achieving what Google's program terms remote code execution [ref_id=1].
Affected code
The vulnerability exists in the Android WebView-based TinyCards application (version 1.0, version code 9). The app loads its initial web content via an unencrypted HTTP call to tinycards.duolingo.com, which then redirects to HTTPS. Because the initial request is plain HTTP, a man-in-the-middle attacker can intercept and replace the response before the redirect occurs [ref_id=1].
What the fix does
The vendor fixed the issue in version 1.0 (version code 10), released November 20, 2017. According to the advisory, the vendor changed the initial request to use HTTPS, eliminating the unencrypted HTTP call that allowed interception. Users should install the latest version from Google Play Store [ref_id=1]. No patch diff is available in the bundle.
Preconditions
- networkAttacker must be on the same network as the victim (e.g., same Wi-Fi) to perform a man-in-the-middle attack.
- networkAttacker must be able to spoof DNS responses or otherwise intercept HTTP traffic to tinycards.duolingo.com.
- configThe victim must be running TinyCards version 1.0 (version code 9) or earlier.
Reproduction
1. Install the TinyCards app on the Android device but do not start it. 2. Install dnsmasq and NGINX on a Linux host. 3. Modify /etc/hosts to map tinycards.duolingo.com to the Linux host's IP. 4. Configure dnsmasq to listen on that IP and restart it. 5. Place malicious content (e.g., `echo powned > /var/www/html/index.html`). 6. Set the Android device's DNS to point to the Linux host. 7. Open the app and observe the injected content [ref_id=1].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- hackerone.com/reports/281605mitrex_refsource_MISC
- wwws.nightwatchcybersecurity.com/2018/01/04/rce-in-duolingos-tinycards-app-for-android-cve-2017-16905/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.