YONO SBI App Vulnerability (CVE-2025-45080) Exposes Millions to Man-in-the-Middle Attacks

Table of Contents

• What Happened?
• Key Highlights of the Vulnerability
• Technical Breakdown: What Went Wrong?
• How Attackers Exploit the Vulnerability
• What Is a Man-in-the-Middle Attack?
• Risk Summary
• Who Discovered the Vulnerability?
• Why This Is a Big Deal
• Real-World Scenarios of Exploitation
• Recommendations for SBI Customers
• Conclusion
•  Frequently Asked Questions (FAQs)

What Happened?

A newly disclosed vulnerability in the YONO SBI: Banking & Lifestyle app (version 1.23.36) puts millions of users at risk of Man-in-the-Middle (MITM) attacks due to insecure network configurations. Identified as CVE-2025-45080, the flaw stems from the use of unencrypted HTTP traffic, a critical security misstep in any financial application.

Key Highlights of the Vulnerability

• CVE-2025-45080 affects YONO SBI app version 1.23.36.

• Caused by android:usesCleartextTraffic="true" in the manifest file.

• Allows unencrypted data transmission via HTTP.

• Can be exploited using Wi-Fi sniffing and MITM attack tools.

• Users' login credentials, personal details, and financial transactions are at high risk.

• Assigned a CVSS v3.1 score of 8.8 (High severity).

Technical Breakdown: What Went Wrong?

The Configuration Flaw

The YONO SBI Android app’s manifest file contains the entry:

This setting explicitly permits the app to send and receive data via unencrypted HTTP, even when Android OS security best practices disallow cleartext traffic by default since API level 28 (Android 9.0).

This opens the door to MITM attacks on public Wi-Fi or compromised networks where attackers can observe or alter HTTP traffic.

How Attackers Exploit the Vulnerability

Tools Required:

• APK decompiler like APKTool

• Network sniffing tools such as Wireshark or Burp Suite

Attack Steps:

1. Decompile the APK to confirm the insecure configuration.

2. Connect to the same network as the victim (e.g., a café Wi-Fi).

3. Use a proxy to intercept unencrypted HTTP data.

4. Read or tamper with login credentials, transaction data, or PII.

No special authentication or exploit payload is required — just being on the same network and watching the traffic is enough.

What Is a Man-in-the-Middle Attack?

A Man-in-the-Middle (MITM) attack occurs when a malicious actor secretly intercepts or alters communication between two parties — in this case, between the YONO SBI app and the bank's servers.

Attackers can:

• Steal login credentials

• Monitor account balances

• Alter transaction values

• Redirect payments

Risk Summary

Who Discovered the Vulnerability?

Security researcher Ishwar Kumar responsibly disclosed the flaw. The vulnerability was found through APK reverse engineering and validated with network traffic monitoring tools.

Why This Is a Big Deal

 Banking apps handle:

• Authentication data

• Account balances

• Transaction records

• User PII

Sending any of this over HTTP is a major red flag. While HTTPS encrypts traffic, HTTP does not — making it easy for attackers to read or manipulate data in transit.

Real-World Scenarios of Exploitation

Public Wi-Fi Danger

Users accessing the YONO SBI app on airports, cafés, or hotel Wi-Fi could unknowingly expose their banking data to attackers on the same network.

Rogue Access Points

Attackers could set up fake Wi-Fi hotspots mimicking legitimate ones, then intercept cleartext HTTP data flowing through the app.

Recommendations for SBI Customers

• Avoid using the YONO app on public or shared networks.

• Enable multi-factor authentication (MFA) where possible.

• Monitor bank transactions regularly for any suspicious activity.

• Update the app as soon as SBI releases a patched version.

• Use VPNs to encrypt traffic if you must access banking apps on open networks.

Recommendations for Developers

• Always disable usesCleartextTraffic in production financial apps.

• Enforce HTTPS-only communication using Android Network Security Config.

• Implement SSL pinning to prevent MITM even on HTTPS.

• Conduct security reviews and static code analysis before release.

• Align app development with OWASP Mobile Top 10 standards.

Conclusion

The CVE-2025-45080 vulnerability in the YONO SBI app is a reminder that misconfigured apps can defeat even the best encryption protocols. While the flaw is relatively easy to fix, its consequences are severe — especially in financial applications where trust and confidentiality are paramount.

With the popularity of digital banking rising, such vulnerabilities underline the urgent need for secure-by-design app development practices.