Vatican's Official Prayer App Exposes Over 700,000 Users' Personal Data
The Vatican's official prayer app, 'Click To Pray,' has leaked the personal information of more than 700,000 global users due to an insecure API endpoint.
The Vatican's official prayer app, "Click to Pray," has inadvertently exposed the personal data of over 700,000 users worldwide. The breach, discovered by a white hat hacker known as "BobDaHacker," stems from an insecure direct object reference (IDOR) vulnerability in the app's associated website, clicktopray.org.
This vulnerability allowed any internet user to query a specific, unprotected API endpoint and access sensitive personally identifying information (PII) belonging to "Click to Pray" account holders, as well as employees of the Pope's Worldwide Prayer Network, the organization that operates the app. Dark Reading independently verified the flaw, which remains exploitable at the time of reporting.
To register for an account on "Click to Pray," users are required to provide their first and last name, email address, and password, with an optional field for their country of origin. The application assigns a sequential user ID to each account. However, the exposed API endpoint allows attackers to enumerate any user ID and retrieve associated data without any form of authorization.
The leaked information includes users' names and email addresses in plaintext, along with numerical codes representing their countries of origin. Each record also indicates whether the account has been deleted and if it possesses administrative privileges. Notably, the lowest user IDs are associated with "Click to Pray" staff, suggesting that internal accounts may have been compromised first.
Exploiting this vulnerability requires minimal technical skill, involving only a simple script to scrape the data. Threat actors could leverage this information for mass phishing campaigns, impersonating the Pope's Worldwide Prayer Network, or using victims' religious faith to socially engineer them. The ease of access to such a large dataset poses a significant privacy risk.
BobDaHacker highlighted that IDOR vulnerabilities are extremely common, often falling under the "Broken Access Control" category in the OWASP Top 10. This occurs because while many frameworks handle user authentication, they often fail to implement proper authorization checks, leaving developers responsible for ensuring users can only access specific resources they are permitted to see.
Users can mitigate some risks by providing anonymized information during registration, such as using abbreviated names or alphanumeric handles. Additionally, utilizing features like Apple's "Hide My Email" can mask actual email addresses, rendering them inaccessible to attackers even if the API is exploited.
The "Click to Pray" app was developed by La Machi Communication for Good Causes and is owned by the Pope's Worldwide Prayer Network. While religious institutions and smaller communication firms may not always prioritize cybersecurity, the breach underscores that any organization handling substantial user data has a responsibility to protect it. Ironically, the Vatican recently issued its own data protection regulation, emphasizing the need for security measures, risk analyses, and incident reporting, yet this incident demonstrates a gap between policy and practice.