提出 #850975: Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information

During dynamic analysis using Frida, the Meesho Android application (com.meesho.supply) was found storing sensitive user Personally Identifiable Information (PII) in plaintext inside SharedPreferences.
Sensitive data exposed includes:

Full user details (USER key): user_id, phone number, email address, name
Extensive tracking data (super_properties)
Session information (APP_SESSION_EVENT)

Proof of Concept:
A custom Frida script (meeshobug2.js) hooks SharedPreferences.Editor.putString() and logs the following in real-time:
JavaScript[???? PII EXPOSED]
Key : USER
Value : {"user_id":149712167,"phone":"[phone]","email":"[email protected]","name":"Soyam Arya",...}

[???? PII EXPOSED]
Key : super_properties
Value : {"Phone":"[phone]", ...}
Full Frida script used:
JavaScriptJava.perform(function() {
// [Full script as provided earlier - I can paste the complete one if needed]
});
Impact:
Any attacker with physical access to the device can easily extract the user's personal information, phone number, email, and behavioral data. This leads to serious privacy violations, identity theft risks, and potential account compromise.
Root Cause:
Use of plaintext SharedPreferences instead of EncryptedSharedPreferences or Android Keystore.
Recommendations:

Implement EncryptedSharedPreferences with AES-256 encryption.
Store sensitive data in Android Keystore.
Minimize PII stored locally.

• ソース: ⚠️ https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW
• ユーザー: honest_corrupt (UID 85229)
• 送信: 2026年06月07日 11:40 (2 月 ago)
• モデレーション: 2026年08月02日 22:44 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 385419 [Meesho Online Shopping App 迄 20260607 上 Android com.meesho.supply user_id/phone number/email address/name 弱い暗号化]
• ポイント: 20