PT-2020-19728 · Mintegral · Mintegraladsdk

Alyssa Miller · Published 2020-08-24 · Updated 2020-09-02 · CVE-2020-7705

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MintegralAdSDK versions 0.0.0 and later

Description The issue concerns malicious functionality within the MintegralAdSDK that tracks and reports any URL opened by the app, facilitating advertisement attribution fraud. The SDK can remotely activate hooks on various methods, including UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters, and NSURLProtocol, along with employing anti-debug and proxy detection protection. If these hooks are active, the MintegralAdSDK sends obfuscated data about every opened URL to its servers, even if the SDK is not enabled for serving ads.

Recommendations For MintegralAdSDK version 0.0.0, consider disabling the SDK until a patch is available to prevent the malicious functionality from tracking and reporting URL openings. As a temporary workaround, restrict access to the UIApplication, openURL, SKStoreProductViewController, loadProductWithParameters, and NSURLProtocol methods to minimize the risk of exploitation. Avoid using the MintegralAdSDK for serving ads until the issue is resolved to prevent advertisement attribution fraud.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2020-7705

SNYK-COCOAPODS-MINTEGRALADSDK-598852

Affected Products

Mintegraladsdk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-7705 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7705 · Vendor Advisory
• https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-598852 · Note
• https://snyk.io/research/sour-mint-malicious-sdk · Note
• https://snyk.io/blog/sourmint-malicious-code-ad-fraud-and-data-leak-in-ios · Note