CVE-2024-23388 in App
Summary
by MITRE • 01/26/2024
Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/04/2025
The vulnerability identified as CVE-2024-23388 represents a critical authorization flaw within the Mercari Android application that affects versions prior to 5.78.0. This issue stems from improper handling of custom URL schemes within the application's intent processing mechanism, creating a significant security gap that can be exploited by remote attackers to manipulate user navigation. The flaw specifically resides in how the application processes external URL requests that are designed to launch specific application functionalities, allowing malicious actors to craft crafted URLs that bypass normal authorization checks. This vulnerability falls under the CWE-863 category of "Incorrect Authorization" and aligns with ATT&CK technique T1531 which focuses on "Account Access Removal" through manipulation of application behavior. The improper authorization occurs at the application handler level where custom URL schemes are processed without adequate validation of the originating source or the intended destination.
The technical implementation of this vulnerability exploits the Android intent system's trust model where applications can register to handle specific URL schemes and receive requests from external sources. When the Mercari application processes a custom URL scheme, it fails to properly validate whether the incoming request originates from a legitimate source or has been crafted by an attacker. This allows an attacker to construct malicious URLs that, when clicked by a user, can redirect them to phishing websites or other malicious destinations. The vulnerability is particularly dangerous because it leverages the user's trust in the legitimate application to execute unauthorized actions. Attackers can craft URLs that appear to be legitimate Mercari functionality but actually redirect users to attacker-controlled domains designed to harvest credentials or personal information. The flaw essentially creates an unauthorized redirection pathway that bypasses the application's normal security controls and authorization mechanisms.
The operational impact of this vulnerability extends beyond simple phishing attacks to potentially enable more sophisticated social engineering campaigns. Users who interact with malicious URLs may unknowingly navigate to sites designed to steal login credentials, personal information, or financial data. The vulnerability can be exploited through various attack vectors including malicious email attachments, compromised websites, or social media links that contain crafted URLs. Security researchers have identified that this flaw can be leveraged to create convincing phishing campaigns that appear legitimate due to the application's proper handling of authentic Mercari URLs. The risk is particularly elevated because the vulnerability operates at the application level where users expect a certain level of security and trust. This type of vulnerability can also serve as a stepping stone for more complex attacks, potentially allowing attackers to establish persistent access or escalate privileges within the compromised user environment.
Organizations and users should immediately implement mitigations including updating to Mercari version 5.78.0 or later, which contains the necessary patches to address the authorization flaw. Additionally, security teams should monitor for suspicious URL patterns and implement network-level controls to detect and block potentially malicious custom URL scheme requests. The vulnerability highlights the importance of proper input validation and authorization checks in mobile applications, particularly those handling external intents and URL schemes. Security professionals should consider implementing mobile application security testing that includes custom URL scheme handling validation and authorization testing. This vulnerability serves as a reminder of the critical importance of secure intent handling in Android applications and the potential consequences when authorization controls are improperly implemented. The remediation process should include comprehensive testing of all custom URL scheme handlers to ensure proper validation and authorization checks are in place. Organizations should also consider implementing user education programs to help users recognize potentially malicious URLs and understand the risks associated with clicking on untrusted links in mobile applications.