How it was found

1. Summary

The Android application com.yelp.android.biz contains an exposed deep link:

yelp-biz:///debug_navigation

Triggering this deep link externally causes the application to crash. After the application is restarted, the current user session is invalidated and the user is forced to log in again.

Because Android applications can invoke exported deep links in other applications, any malicious application installed on the same device can repeatedly trigger this behavior, resulting in a persistent local Denial of Service (DoS) against the victim.

2. Affected Component

• Package: com.yelp.android.biz
• Deep Link: yelp-biz:///debug_navigation

3. Steps to Reproduce

1. Install and log in to the Yelp Business application.
2. Execute the following command:

adb shell am start -a android.intent.action.VIEW -d "yelp-biz:///debug_navigation"

3. Observe that:

   • The application immediately crashes.
   • Upon reopening the application, the user has been logged out.
   • The user is required to authenticate again.

4. Repeat the command multiple times to continuously interrupt application usage.

4. Proof of Concept

adb shell am start -a android.intent.action.VIEW -d "yelp-biz:///debug_navigation"

5. Security Impact

Any malicious application installed on the same Android device can invoke this deep link without requiring special permissions.

This allows an attacker to:

• Force the Yelp Business application to crash.
• Cause the current user session to be terminated.
• Force repeated logouts.
• Prevent normal use of the application by continuously invoking the vulnerable deep link.
• Create a persistent local Denial of Service against the victim.

Although this issue does not directly expose sensitive information or allow account takeover, it significantly impacts the application's availability and user experience.

6. Real-World Scenario

Consider a seemingly harmless application installed from a third-party marketplace or bundled with another application.

The malicious application silently executes:

Intent intent = new Intent(Intent.ACTION_VIEW);
intent.setData(Uri.parse("yelp-biz:///debug_navigation"));
startActivity(intent);

It can trigger this periodically in the background or whenever the victim attempts to use Yelp Business.

As a result:

• The application repeatedly crashes.
• The user is continuously logged out.
• Business owners may be unable to quickly access orders, messages, or account management features.
• Users may believe their account has been compromised or that the application is unstable.
• This can generate unnecessary support requests, damage user trust, and negatively affect the application's reputation.

Since Yelp Business is used by businesses to manage their operations, repeated forced logouts can disrupt normal workflows and reduce productivity.

7. Root Cause

The application exposes a debug deep link (yelp-biz:///debug_navigation) that is accessible from outside the application.

The deep link is not properly protected or restricted and leads to an unhandled application state that causes:

• Application crash.
• Session invalidation after restart.
• Forced user logout.

Debug or internal navigation endpoints should not be reachable by untrusted external applications, especially when they can affect application availability or authentication state.

Video PoC:

{F6162875}

8. Recommended Fix

• Remove debug deep links from production builds.
• Restrict internal debug routes so they cannot be invoked by external applications.
• Validate incoming deep links before processing.
• Gracefully handle unexpected navigation requests without crashing.
• Ensure application crashes do not invalidate authenticated user sessions unless explicitly required.
• Restrict exported intent filters where external access is unnecessary.