Published:2021/07/13  Last Updated:2021/07/13

JVN#26891339
Multiple vulnerabilities in Retty App

Overview

Retty App provided by Retty Inc. contains multiple vulnerabilities.

Products Affected

  • Retty App for Android versions prior to 4.8.13
  • Retty App for iOS versions prior to 4.11.14

Description

Retty App provided by Retty Inc. contains multiple vulnerabilities listed below.

  • The app is launched by Custom URL Scheme and a user may be led to access an arbitrary URL (CWE-939) - CVE-2021-20747
    CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score: 4.3
    CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N Base Score: 4.3
  • The App uses a hard-coded API key for external services (CWE-798) - CVE-2021-20748
    CVSS v3 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Base Score: 4.0
    CVSS v2 AV:N/AC:L/Au:N/C:P/I:N/A:N Base Score: 5.0

Impact

  • A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack - CVE-2021-20747
  • An attacker may analyze the data in the App and obtain the API key for external services - CVE-2021-20748
Note that the users are not directly affected by CVE-2021-20748 vulnerability.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.

According to the developer, in the fixed version the vulnerable API key (CVE-2021-20748) is inactivated, therefore the information contained in the vulnerable App is no longer compromised.

Vendor Status

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Ryo Sato reported these vulnerabilities to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2021-20747
CVE-2021-20748
JVN iPedia JVNDB-2021-000068