{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "summary",
        "text": "The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).",
        "title": "Risk Evaluation"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries and Areas Deployed"
      },
      {
        "category": "general",
        "text": "Upgrade to Planet Fitness Workouts 9.9.13",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company Headquarters Location"
      },
      {
        "category": "description",
        "text": "Information Technology",
        "title": "Critical Infrastructure Sectors"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "https://www.cisa.gov/report",
      "issuing_authority": "CISA",
      "name": "CISA",
      "namespace": "https://www.cisa.gov"
    },
    "references": [
      {
        "category": "self",
        "summary": "Vulnerability Advisory VA-24-262-01 CSAF",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-262-01.json"
      }
    ],
    "title": "Planet Fitness Workouts mobile apps do not properly validate TLS certificates",
    "tracking": {
      "current_release_date": "2025-02-28T00:00:00Z",
      "generator": {
        "engine": {
          "name": "VINCE-NT",
          "version": "1.7.0"
        }
      },
      "id": "VA-24-262-01",
      "initial_release_date": "2024-09-23T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-02-28T00:00:00Z",
          "number": "1.1.0",
          "summary": "Updated affected version range and fixed version"
        },
        {
          "date": "2024-09-23T00:00:00Z",
          "number": "1.0.0",
          "summary": "Initial publication"
        }
      ],
      "status": "final",
      "version": "1.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.9.13",
                "product": {
                  "name": "Planet Fitness Planet Fitness Workouts \u003c9.9.13",
                  "product_id": "CSAFPID-0001"
                }
              },
              {
                "category": "product_version",
                "name": "9.9.13",
                "product": {
                  "name": "Planet Fitness Planet Fitness Workouts 9.9.13",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Planet Fitness Workouts"
          }
        ],
        "category": "vendor",
        "name": "Planet Fitness"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Dennis Giese"
          ]
        },
        {
          "names": [
            "Braelynn Luedtke"
          ]
        }
      ],
      "cve": "CVE-2024-43201",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "SSVCv2/E:P/A:N/T:T/2024-09-23T20:03:29Z/",
          "title": "SSVC"
        },
        {
          "category": "description",
          "text": "optional zzzzz",
          "title": "Vendor statement from Planet Fitness"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0002"
        ],
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "apps.apple.com",
          "url": "https://apps.apple.com/us/app/planet-fitness-workouts/id399857015"
        },
        {
          "category": "external",
          "summary": "dontvacuum.me",
          "url": "https://dontvacuum.me/bugs/pf/"
        }
      ],
      "release_date": "2024-09-23T00:00:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-02-11T05:00:00Z",
          "details": "Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2025-02-11T05:00:00Z",
          "details": "Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).",
          "product_ids": [
            "CSAFPID-0002"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "Planet Fitness Workouts mobile apps do not properly validate TLS certificates"
    }
  ]
}