[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-147620-105":59,"doc-detail-147620-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","vapt-for-trust-plus-wallet-security-assessment-report","VAPT for Trust Plus Wallet - Security Assessment Report","","VAPT report for Trust Plus Wallet presents a black-box security assessment focused on the Trustee Plus iOS app and related backend GraphQL API. The engagement verifies robustness against external threat actors without access to API documentation or pre-provided test accounts, relying on self-created accounts for coverage. The assessment identifies three findings, including one high-severity issue with account takeover impact, and details technical descriptions, applicable proof-of-concepts, and remediation recommendations.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/vapt-for-trust-plus-wallet-security-assessment-report/147620/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/vapt-for-trust-plus-wallet-security-assessment-report/147620.png","ImageObject",300,407,{"name":92,"@type":93},"8796093062539","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-17","2026-08-26",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",14,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"What was the scope of the VAPT assessment for Trust Plus Wallet?","Question",{"text":113,"@type":114},"The assessment covered the Trustee Plus iOS app and the backend API at apollo.trusteeglobal.com.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How was GraphQL introspection discovered and why is it a risk?",{"text":118,"@type":114},"Introspection queries were used to enumerate schema information and available operations. Enabling introspection can expose sensitive schema details and help attackers craft malicious queries.",{"name":120,"@type":111,"acceptedAnswer":121},"What vulnerability could lead to account takeover in the Telegram OAuth flow?",{"text":122,"@type":114},"The Telegram bot OAuth2 integration is implemented incorrectly, allowing an attacker to gain access to the wallet using arbitrary mobile numbers, enabling account takeover.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},147620,1787767290,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":66,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":130,"read_time":144,"preview_page_count":4},8796093062539,"| Project: | VAPT for Trust Plus Wallet |  |  |\n| --- | --- | --- | --- |\n| Client: | Trust Plus |  |  |\n| Tester: | [ha](ha@vendetta.ng)[@vendetta.ng](ha@vendetta.ng)[ ](ha@vendetta.ng)Hafiz Abdul-aziz | Start date:\u003Cbr>Finish date: | 17.02.2025\u003Cbr>21.02.2025 |\n|  |  | Document version: | 1.0 |\n| Client Contact: |  |  |  |\n\nPage was intentionally left blank  \nDisclaimer  \nDo not disclose this report to un-authorized third parties. This document contains vulnerabilities of high exploitation potential. Vendetta will not be held liable when a malicious actor finds and exploits the vulnerabilities before aremediation fix.  \nPentest-Report “Trustee Plus Wallet” 20.-02.2025  \nBy Vendetta Security-Defending your Digital Frontier  \n[ha@](ha@vendetta.ng-Hafiz Abdul-aziz)[vendetta.ng](ha@vendetta.ng-Hafiz Abdul-aziz)[-Hafiz Abdul-aziz](ha@vendetta.ng-Hafiz Abdul-aziz), Offensive Security Professional. Penetration Tester.  \nIndex  \nSummary  \nScope  \nFindings  \nTPW-01-001 GraphQL Introspection enabled in Production (Low)  \nTPW-01-002 Broken Telegram oAuth flow on Trust wallet leads to Account Takeover (High) TPW-01-003 No screenshot protection (Info)  \nConclusions  \nAppendix  \nIntroduction  \nThis report documents the findings of a security assessment targeting the Trust Plus Wallet. With Trustee Plus, you can buy crypto with a debit card. Purchase BTC, ETH, and other  \ncryptocurrencies using a Visa or MasterCard.  \nThe security assessment was conducted using a black-box methodology. The test team was not granted access to the API documentation nor test accounts. However, test accounts were created to enable to team reach adequate coverage for the assessment. The goal of this engagement was therefore to have an independent third party verify whether the security of Trust Wallet app and its relevant web services are robust against external threat actors.  \nThe team managed to spot a total of 3 findings, one of which were classified as high with possible exploitation potential. Each finding was accompanied by a technical description, a proof-of-concept (PoC) where applicable, as well as advice for fix. The report then closes with a conclusion in which Vendetta elaborated on the general impressions gained throughout this test and share some viewson the perceived security posture of the scope.  \nScope  \n◦ Trustee Plus iOS app  \n◦ Backend API [[https://apollo.trusteeglobal.com](https://apollo.trusteeglobal.com)]  \nTPW-01-003 GraphQL Introspection enabled in Production (Low)  \nGraphQL introspection is a special query that uses the   schema field to interrogate GraphQL for its schema. Introspection in itself is not a weakness, but a feature. However, if it is made available, it can be used and abused by attackers seeking information about your GraphQL implementation, such as what queries and mutations exist. It is recommended to disable introspection in production to avoid data leakages.  \nIntrospection is a built-in GraphQL function that enables you to query a server for information about the schema.  \nHow we discovered the Schema information  \nTo discover the underlying schema for Wallet API, we used introspection queries to query that server information.  \n1. We probed for introspection using the following query. The response returned the names of all available queries.  \nRequest  \nPOST /graphql [HTTP/2](HTTP/2)  \nHost: [apollo.trusteeglobal.com](apollo.trusteeglobal.com)  \nContent-Type: application/json Currentotpcode:  \nCurrentdeviceid: 9526A2F8-E6FF-42D5-A50C-A0504A381D1D  \nAccept: */*  \nVersion: 1101  \nCurrentlanguage: en-US  \nCurrentsubaccount: none  \nAccept-Language: en-US,en;q=0.9  \nAccept-Encoding: gzip, deflate, br  \nContent-Length: 35  \nUser-Agent: Trustee %20Plus/1101 CFNetwork/1410 .1 Darwin/22 .6 .0  \nCurrentauthbearer: 895dadb5fba4d483e1e5ea8e1b89f3c9e662dd78@a42476d8-2673- 4cee-87d3-8e337d63ad9a-9d50c941-3209-402d-8fc9-10e5b2c8a5a4 Currentappsflyers: {\"appsFlyerUID\":\"1739800031268-9526286\"}  \nConnection: keep-alive  \n{\"query\":\"{","cbCaivAMDrQo3Tch","https://ap.wps.com/l/cbCaivAMDrQo3Tch","pdf",1620720,17,"English","# Summary\n# Scope\n# Findings\n## TPW-01-001 GraphQL Introspection enabled in Production (Low)\n## TPW-01-002 Broken Telegram oAuth flow on Trust wallet leads to Account Takeover (High)\n## TPW-01-003 No screenshot protection (Info)\n# Conclusions\n# Appendix","[{\"question\":\"What was the scope of the VAPT assessment for Trust Plus Wallet?\",\"answer\":\"The assessment covered the Trustee Plus iOS app and the backend API at apollo.trusteeglobal.com.\"},{\"question\":\"How was GraphQL introspection discovered and why is it a risk?\",\"answer\":\"Introspection queries were used to enumerate schema information and available operations. Enabling introspection can expose sensitive schema details and help attackers craft malicious queries.\"},{\"question\":\"What vulnerability could lead to account takeover in the Telegram OAuth flow?\",\"answer\":\"The Telegram bot OAuth2 integration is implemented incorrectly, allowing an attacker to gain access to the wallet using arbitrary mobile numbers, enabling account takeover.\"}]","VAPT for Trust Plus Wallet - Security Assessment Report | PDF",43]