JVN#66422035: Android Apps developed using Yappli fails to restrict custom URL schemes properly

Yappli provided by Yappli, Inc. is an application development platform.
Android Apps that are developed with Yappli provide the function to access a requested URL using Custom URL Scheme.
The access to the function is not restricted properly (CWE-939) which may be exploited to direct the App to connect to unintended sites.

Impact

When accessing a malicious website containing a specially crafted URL, the vulnerable app may be directed to connect to some unintended site.
As a result, the app’s internal information may be leaked and/or altered.

Solution

Solution for developers of affected applications
Rebuild the application in the latest development environment. Until the rebuilt version is published, remove the affected version from an application store.

Solution for users of affected applications
Please inquire the application developer.

Products Affected

• Android Apps that are developed in Yappli since v7.3.6 and prior to v9.30.0