CVE-2021-20873

Vulnerability

Android apps developed with Yappli versions since v7.3.6 and prior to v9.30.0 contain an improper authorization vulnerability in the Custom URL Scheme handler (CWE-939). The app provides a function to access a requested URL via a custom URL scheme, but access to this function is not properly restricted [1].

Exploitation

An attacker can craft a malicious website containing a specially crafted URL. If a user of the vulnerable app visits this website, the app may be directed to connect to unintended sites [1]. The attacker requires no authentication but relies on user interaction (the user must click on the malicious link).

Impact

Successful exploitation could allow an attacker to leak or alter internal information of the vulnerable app. According to the CVSS v3 score, the primary impact is on integrity (high), with no impact on confidentiality or availability [1].

Mitigation

Developers should rebuild the affected application using the latest Yappli development environment (version 9.30.0 or later). Until the rebuilt version is published, remove the affected version from the app store. Users should contact the application developer for guidance [1].