제출 #850975: Meesho Meesho Android App Latest (com.meesho.supply) CWE-312 Cleartext Storage of Sensitive Information

During dynamic analysis using Frida, the Meesho Android application (com.meesho.supply) was found storing sensitive user Personally Identifiable Information (PII) in plaintext inside SharedPreferences.
Sensitive data exposed includes:

Full user details (USER key): user_id, phone number, email address, name
Extensive tracking data (super_properties)
Session information (APP_SESSION_EVENT)

Proof of Concept:
A custom Frida script (meeshobug2.js) hooks SharedPreferences.Editor.putString() and logs the following in real-time:
JavaScript[???? PII EXPOSED]
Key : USER
Value : {"user_id":149712167,"phone":"[phone]","email":"[email protected]","name":"Soyam Arya",...}

[???? PII EXPOSED]
Key : super_properties
Value : {"Phone":"[phone]", ...}
Full Frida script used:
JavaScriptJava.perform(function() {
// [Full script as provided earlier - I can paste the complete one if needed]
});
Impact:
Any attacker with physical access to the device can easily extract the user's personal information, phone number, email, and behavioral data. This leads to serious privacy violations, identity theft risks, and potential account compromise.
Root Cause:
Use of plaintext SharedPreferences instead of EncryptedSharedPreferences or Android Keystore.
Recommendations:

Implement EncryptedSharedPreferences with AES-256 encryption.
Store sensitive data in Android Keystore.
Minimize PII stored locally.

• 원천: ⚠️ https://github.com/honestcorrupt/MEESHO-CVE_REQUEST_NEW
• 사용자: honest_corrupt (UID 85229)
• 제출: 2026. 06. 07. AM 11:40 (2 개월 ago)
• 모더레이션: 2026. 08. 02. PM 10:44 (2 months later)
• 상태: 수락
• VulDB 항목: 385419 [Meesho Online Shopping App 까지 20260607 켜짐 Android com.meesho.supply user_id/phone number/email address/name 약한 암호화]
• 포인트들: 20