जमा करें #850975: Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information

During dynamic analysis using Frida, the Meesho Android application (com.meesho.supply) was found storing sensitive user Personally Identifiable Information (PII) in plaintext inside SharedPreferences.
Sensitive data exposed includes:

Full user details (USER key): user_id, phone number, email address, name
Extensive tracking data (super_properties)
Session information (APP_SESSION_EVENT)

Proof of Concept:
A custom Frida script (meeshobug2.js) hooks SharedPreferences.Editor.putString() and logs the following in real-time:
JavaScript[???? PII EXPOSED]
Key : USER
Value : {"user_id":149712167,"phone":"[phone]","email":"[email protected]","name":"Soyam Arya",...}

[???? PII EXPOSED]
Key : super_properties
Value : {"Phone":"[phone]", ...}
Full Frida script used:
JavaScriptJava.perform(function() {
// [Full script as provided earlier - I can paste the complete one if needed]
});
Impact:
Any attacker with physical access to the device can easily extract the user's personal information, phone number, email, and behavioral data. This leads to serious privacy violations, identity theft risks, and potential account compromise.
Root Cause:
Use of plaintext SharedPreferences instead of EncryptedSharedPreferences or Android Keystore.
Recommendations:

Implement EncryptedSharedPreferences with AES-256 encryption.
Store sensitive data in Android Keystore.
Minimize PII stored locally.

• स्रोत: ⚠️ https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW
• उपयोगकर्ता: honest_corrupt (UID 85229)
• सबमिशन: 07/06/2026 11:40 AM (2 महीनों पहले)
• संयम: 02/08/2026 10:44 PM (2 months later)
• स्थिति: स्वीकृत
• VulDB प्रविष्टि: 385419 [Meesho Online Shopping App तक 20260607 पर Android com.meesho.supply user_id/phone number/email address/name कमजोर एन्क्रिप्शन]
• अंक: 20