A popular Vatican website and mobile app has been leaking hundreds of thousands of users’ names and email addresses.
“Click to Pray” is the Vatican’s official prayer app. Users can sign up for access to daily prayers, and a steady stream of papal content on their phones or computers. It’s available on iOS and Android, and via a Web browser. According to its website, Click to Pray is used in more or less every country on the planet.
In January, the white hat hacker “BobDaHacker” discovered an insecure direct object reference (IDOR) vulnerability in clicktopray.org. Any passing Internet user could query a specific, totally exposed application programming interface (API) endpoint to see basic personally identifying information (PII) belonging to all of Click to Pray’s account holders, as well as active employees of the organization that runs the app, the Pope’s Worldwide Prayer Network.
Dark Reading independently tested and confirmed the vulnerability. It contacted the Pope’s Worldwide Prayer Network, to try to help the independent hacker get the issue fixed. Having failed at that, it then reached out to La Machi — the communications company that designed and developed the app — for comment on this story, but hasn’t received a response yet.
Click to Leak
To sign up for an account on Click to Pray, you must supply a first and last name, an email address, and a password, with an optional field to indicate what country you’re from. Behind the scenes, once your account is created, you’re assigned a sequential user ID.
Unfortunately, the website exposes an API endpoint that then leaks your information to anybody, no authorization required. If an attacker discovers the endpoint, and supplies any user ID, they can enumerate any number of the site’s users, plus administrative and staff accounts.
Dark Reading confirmed that the issue remains live as of the time of publication. It requires no technical skill to exploit, only a single domain entered into a browser’s address bar. More than 700,000 user accounts are freely available, and the lowest-numbered user IDs are associated with Click to Pray staff. Email addresses and names are leaked in plaintext, and countries of origin are assigned numerical values. Each listing also indicates whether the associated account has been deleted, and whether it possesses administrative privileges (those without are assigned the role “PRAYER”).
Any attacker who wants to scrape all this data could do so using a simple script. At that point, it would be trivial to mass email all the site’s users, impersonating the Pope’s Worldwide Prayer Network, or otherwise leveraging victims’ faith to socially engineer them.
How to Protect Yourself from Vulnerable Apps
BobDaHacker acknowledges that the Pope isn’t the first fella to have this problem.
“IDORs are incredibly common. Broken Access Control has been the number one vulnerability category in the OWASP Top 10 since 2021, and IDOR is probably the single most common flavor of it. I find them constantly. Across every industry, every tech stack, every size of company,” they say.
The reason developers keep falling into this same trap, they explain, “is that most frameworks handle authentication for you but don’t handle authorization. Your framework will check ‘Is this person logged in?’ but it won’t check ‘Should this person be allowed to see this specific resource?’ That second check is on the developer to implement, and it’s really easy to forget when you’re moving fast and building features.”
Users can protect themselves from the worst consequences of using insecure apps by anonymizing the information they provide during the account registration process. For example, Dark Reading observed that many Click to Pray users provided abbreviated names or alphanumeric handles when signing up for their accounts. Many also appear to have signed up using Apple devices, and took advantage of Apple’s “Hide my Email” feature, which supplies the website with a gibberish relay email address instead of the real one it forwards to. As a result, those users’ email addresses and even their names are inaccessible to hackers, despite the site’s leaky endpoint.
Security for Non-Technical Organizations
Click to Pray was designed and developed by La Machi Communication for Good Causes, a midsized Spanish-language communications agency. It is the property of the Pope’s Worldwide Prayer Network, a global foundation of the Vatican.
Religious institutions and boutique communications companies aren’t typically the most cybersecurity-forward kinds of organizations. Basic cybersecurity vulnerabilities might come with the territory. “Organizations handling hundreds of thousands of users’ personal data have a responsibility to protect it regardless of whether they’re a tech company or a church,” says BobDaHacker. “If you’re collecting emails, names, and dates of birth from 700,000 people, you’re a data custodian, whether you like it or not. Your mission statement doesn’t change that.”
Ironically, the Vatican did issue its own personal data protection regulation on April 30, 2024, as Decree No. DCLVII. Translating from the original text in Italian, Dark Reading found ample stipulations that reference the need to establish “appropriate security measures to achieve the objectives of protecting personal data,” risk analyses, “individuals authorized to implement security measures,” a process for reporting issues to security leaders, and more.
Evidently, the self-imposed regulations haven’t done the trick so far. What, then, can drag immature organizations over the line, to attain an acceptable baseline of cybersecurity?
“I think the answer is making security basics so accessible and so normalized that not having a security contact is as weird as not having a Contact page,” BobDaHacker says. “We’re not there yet. But every time a story like this comes out, it moves the needle a little.”
