Shopify · Report #1737358
URL Scheme Validation Bypass in Shopify Mobile App Allows Javascript Execution
Summary
A vulnerability in the Shopify mobile application allowed bypassing URL scheme validation in the NavigationActivity component. Attackers could craft malicious URLs using data: or javascript: schemes to execute JavaScript code within the app's webview context. JavaScript execution with potential access to device files through exposed interfaces. Exploitation required installation of a malicious app and significant user interaction.
How it was found
Summary:
[------------------------------------Package Details---------------------------------------]: | Application Name :Shopify | Package Name :com.shopify.mobile | Version code :33070 | Version Name :9.85.1 | Mimimum SDK :26 | Target SDK :32 | Max SDK :None | Sha256 :602982573bab04349ad812799319959e6236a746a41f88c7ec0196157ba15027 [------------------------------------------------------------------------------------------]
Shops Used to Test:
█████████.myshopify.com
Steps To Reproduce:
It was found that the com.shopify.mobile app doesn't validate the scheme of the url given as an extra parameter to the com.shopify.mobile.navigation.NavigationActivity which may allow the loading of arbitrary html content (including js code) in the application's webview and the takeover of the SmartWebview , EASDK js interface.
To reproduce, use the apk provided
█████
Supporting Material:
Expected behaviour:
{F1989590}
Impact
Execution of js code ,including of running java code via the EASDK and SmartWebview interfaces.