{"edition": 1, "objectVersion": "1.2", "id": "HACKAPP:COM.KICK.SUBWAY.TRAIN.DRIVER.APK", "reporter": "Hackapp.org", "hashmap": [{"hash": "add6f7c86820a1571dbb01ed466ee407", "key": "affectedSoftware"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "d4be9c4fc84262b4f39f89565918568f", "key": "cvss"}, {"hash": "8e65270aac581310973bbddb7f8319ab", "key": "description"}, {"hash": "1d8e1c1f02f0869cae40aa0823edbf14", "key": "hackapp"}, {"hash": "a6b1de43e3076858c633d7d0192cba6b", "key": "href"}, {"hash": "ecb5e4ed10d0c2000aa2b4669373e5ee", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "ecb5e4ed10d0c2000aa2b4669373e5ee", "key": "published"}, {"hash": "a33ed907a42602b6f89f3f338e853f7b", "key": "references"}, {"hash": "3b012aae1848bb95fe11f3cebae83cb0", "key": "reporter"}, {"hash": "d6c53bacfd8b06c703cf454632201039", "key": "title"}, {"hash": "96e87ef1fcc8d9d3cdd337488987c423", "key": "type"}, {"hash": "cfcd208495d565ef66e7dff9f98764da", "key": "viewCount"}], "viewCount": 1, "href": "https://hackapp.com/report/d801780f111e4c8013f8126866f7bc08", "references": ["https://play.google.com/store/apps/details?id=com.kick.subway.train.driver&hl=en"], "hash": "4cf75ed660fc21357b6a7dba690faed605e6dbead9a23a183167afbd581e8f28", "modified": "2016-04-01T10:07:01", "lastseen": "2016-09-26T20:43:33", "cvelist": [], "hackapp": {"apk": "COM.KICK.SUBWAY.TRAIN.DRIVER.APK", "icon": "http://lh3.ggpht.com/8d9koBe06AgCkJEOxAAV7oVQPxHYt-rUUwVcvAY7XrJab8XacQf6-twb5Fem9JwoiWg=w300", "link": "https://play.google.com/store/apps/details?id=com.kick.subway.train.driver&hl=en", "name": "Bullet Train Subway Station 3D", "version": "1.0.3", "bugs": [{"name": "Customized SSL", "description": "\n\t\t\tCheck certificate validation. Do not create or redefine X509Certificate class methods by yourself, if you don't understand risks. Use the existing API.\n\t\t\t", "id": "79725660231f284bab16a93d95aad77f", "severity": "critical"}, {"name": "Suspicious files", "description": "Are you sure these files should be here?", "id": "03250ec9561c2b5306086db24a4ac57f", "severity": "notice"}, {"name": "WebView files access", "description": "Control of WebView context allows to access local files.\n\t\t\t", "id": "b35de9c87649bede2156a510c3360ad6", "severity": "medium"}, {"name": "Native code usage", "description": "Native code (.so) usage 'System.loadLibrary();' is found.", "id": "3c5d68128a7139e7e532800b7ffd3fb3", "severity": "notice"}, {"name": "External URLs", "description": "Were do they point?", "id": "7328cd86ff5f887d635075926b15bac6", "severity": "notice"}, {"name": "WebView JavaScript enabled", "description": "WebView 'setJavaScriptEnabled(true)' could be exploited during cross-site scripting attacks.", "id": "c8582fbabe4cdf75410d50f7b4bda4c5", "severity": "medium"}, {"name": "Dynamic Code Loading", "description": "Code for 'DexClassLoader' could be tampered.", "id": "d99306d5185e7dee3ea5035e31899942", "severity": "medium"}, {"name": "SD-card access", "description": "SD-cards and other external storages have 'worldwide read' policy.", "id": "ea34e66df59bddda93b4498ebd1926b3", "severity": "medium"}, {"name": "Dangerous filesystem permissions", "description": "Files created with these methods could be worldwide readable.", "id": "9c8fed321d0f8fd0942cb7bccd1d6e01", "severity": "critical"}, {"name": "WebView code execution", "description": "WebView 'addJavascriptInterface' could be used to control the host app with JavaScript bindings. Remote Code Execution (RCE) is possible.", "id": "dcb23139400c018a715afb1f8eac5625", "severity": "critical"}, {"name": "Unsafe deleting", "description": "All items deleted with 'file.delete()' could be recovered.", "id": "1800de2ce7ce1fc39b3a4b1e2b88d8b1", "severity": "notice"}], "store": "play", "release": "2015-03-02T00:00:00", "vendor": "Kick Time Studios"}, "type": "hackapp", "description": "HackApp vulnerability scanner discovered that application Bullet Train Subway Station 3D published at the 'play' market has multiple vulnerabilities.", "bulletinFamily": "software", "cvss": {"vector": "NONE", "score": 0.0}, "published": "2016-04-01T10:07:01", "affectedSoftware": [{"version": "1.0.3", "name": "Bullet Train Subway Station 3D", "operator": "le"}], "history": [], "title": "Bullet Train Subway Station 3D - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities", "enchantments": {"vulnersScore": 5.4}}

{"result": {}}