PT-2024-29633 · Rakuten · Rakuten Ichiba App For Android+1

Shiga Takuma · Published 2024-08-28 · Updated 2024-08-30 · CVE-2024-41918

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rakuten Ichiba App for Android versions 12.4.0 and earlier Rakuten Ichiba App for iOS versions 11.7.0 and earlier

Description The issue concerns improper authorization in the handler for the custom URL scheme, allowing an arbitrary site to be displayed on the WebView of the product via Intent from another application installed on the user's device. This could result in the user being redirected to an unauthorized site, potentially leading to a phishing attack.

Recommendations For Rakuten Ichiba App for Android versions 12.4.0 and earlier, update to a version later than 12.4.0 to resolve the issue. For Rakuten Ichiba App for iOS versions 11.7.0 and earlier, update to a version later than 11.7.0 to resolve the issue. As a temporary workaround, consider restricting the use of custom URL schemes in the app to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-939

Related Identifiers

CVE-2024-41918

Affected Products

Rakuten Ichiba App For Android

Rakuten Ichiba App For Ios

References · 11

• https://osv.dev/vulnerability/CVE-2024-41918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41918 · Security Note
• https://t.me/cvenotify/92635 · Telegram Post
• https://t.me/cvenotify/92762 · Telegram Post
• https://apps.apple.com/jp/app/id419267350 · Note
• https://jvn.jp/en/jp/JVN56648919 · Note
• https://twitter.com/VulmonFeeds/status/1829160157986656645 · Twitter Post
• https://t.me/cvenotify/92873 · Telegram Post
• https://t.me/cvedetector/4369 · Telegram Post
• https://play.google.com/store/apps/details?id=jp.co.rakuten.android&hl=en · Note
• https://twitter.com/CVEnew/status/1828995254738911419 · Twitter Post