PT-2023-14166 · Ryde · Ryde

Published 2023-01-06 · Updated 2023-01-11 · CVE-2022-42979

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RYDE application version 5.8.43

Description The issue is related to information disclosure due to insecure hostname validation, allowing attackers to take over an account via a deep link. This can be exploited in the RYDE application for both Android and iOS.

Recommendations For RYDE application version 5.8.43, consider disabling deep link functionality until a patch is available to prevent account takeover. Restrict access to sensitive account information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Improper Certificate Validation

Weakness Enumeration

CWE-200

CWE-295

Related Identifiers

CVE-2022-42979

Affected Products

Ryde

References · 5

• 🔥 https://medium.com/@jalee0606/how-i-found-my-first-one-click-account-takeover-via-deeplink-in-ryde-5406010c36d8 · Exploit
• https://osv.dev/vulnerability/CVE-2022-42979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42979 · Security Note
• https://medium.com/%40jalee0606/how-i-found-my-first-one-click-account-takeover-via-deeplink-in-ryde-5406010c36d8 · Note
• https://t.me/cvenotify/41366 · Telegram Post