إرسال #850975: Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information

During dynamic analysis using Frida, the Meesho Android application (com.meesho.supply) was found storing sensitive user Personally Identifiable Information (PII) in plaintext inside SharedPreferences.
Sensitive data exposed includes:

Full user details (USER key): user_id, phone number, email address, name
Extensive tracking data (super_properties)
Session information (APP_SESSION_EVENT)

Proof of Concept:
A custom Frida script (meeshobug2.js) hooks SharedPreferences.Editor.putString() and logs the following in real-time:
JavaScript[???? PII EXPOSED]
Key : USER
Value : {"user_id":149712167,"phone":"[phone]","email":"[email protected]","name":"Soyam Arya",...}

[???? PII EXPOSED]
Key : super_properties
Value : {"Phone":"[phone]", ...}
Full Frida script used:
JavaScriptJava.perform(function() {
// [Full script as provided earlier - I can paste the complete one if needed]
});
Impact:
Any attacker with physical access to the device can easily extract the user's personal information, phone number, email, and behavioral data. This leads to serious privacy violations, identity theft risks, and potential account compromise.
Root Cause:
Use of plaintext SharedPreferences instead of EncryptedSharedPreferences or Android Keystore.
Recommendations:

Implement EncryptedSharedPreferences with AES-256 encryption.
Store sensitive data in Android Keystore.
Minimize PII stored locally.

• المصدر: ⚠️ https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW
• المستخدم: honest_corrupt (UID 85229)
• ارسال: 07/06/2026 11:40 AM (2 أشهر منذ)
• الاعتدال: 02/08/2026 10:44 PM (2 months later)
• الحالة: تمت الموافقة
• إدخال VulDB: 385419 [Meesho Online Shopping App حتى 20260607 على Android com.meesho.supply user_id/phone number/email address/name تشفير ضعيف]
• النقاط: 20