Microsoft on Wednesday revealed details of a “high severity vulnerability” now patched in the TikTok app for Android that could allow attackers to take over accounts when victims click on a malicious link.
“Attackers could have exploited the vulnerability to hijack an account without users’ knowledge if a targeted user simply clicked on a specially crafted link,” Dimitrios Valsamaras of the Microsoft 365 Defender research team said in a writing.
Successful exploitation of the flaw could have allowed malicious actors to access and modify TikTok profiles and users’ sensitive information, leading to the unauthorized exposure of private videos. Attackers could also have abused the bug to send messages and upload videos on behalf of users.
The issue, addressed in version 23.7.3, affects two types of its Android app com.ss.android.ugc.trill (for users in East and Southeast Asia) and com.zhiliaoapp. musically (for users in other countries except India, where it is prohibited). Together, the apps have more than 1.5 billion installs between them.
Tracked as CVE-2022-28799 (CVSS Score: 8.8), the vulnerability is related to the application’s handling of what is called a deep link, a special hyperlink that allows applications to open a specific resource inside another app installed on the device instead of targeting it. users to a website.
“A crafted URL (unvalidated deep link) can force com.zhiliaoapp.musically WebView to load an arbitrary website,” according to a warning for the bug. “This may allow an attacker to exploit an attached JavaScript interface for a one-click takeover.”
Simply put, the flaw allows applications to bypass restrictions to reject untrusted hosts and load any website the attacker chooses using Android System WebView, a mechanism for displaying web content in other applications.
“The filtering takes place on the server side, and the decision to load or reject a URL is based on the response received from a particular HTTP GET request,” Valsamaras explained, adding that static analysis “indicated that it is possible to bypass the server-side check by adding two extra parameters to the deep link.”
One consequence of this exploit designed to hijack WebView to load rogue websites is that it could allow an adversary to invoke more than 70 exposed TikTok endpoints, effectively compromising the integrity of a user’s profile. There is no evidence that the bug has been weaponized in the wild.
“From a programming perspective, using JavaScript interfaces carries significant risks,” Microsoft noted. “A compromised JavaScript interface may allow attackers to execute code using the application’s identity and privileges.”