JVN#77402327: NITORI App fails to restrict access permissions

NITORI App provided by Nitori Holdings Co., Ltd. implements the function to access a requested URL using Custom URL Scheme.
This function contains an improper access control vulnerability (CWE-284) that may allow the vulnerable App to receive an request from an arbitrary App and execute the access.

Impact

A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

Solution

Update the Application
Update the application to the latest version according to the information provided by the developer.

Products Affected

• NITORI App for Android versions 6.0.4 and earlier
• NITORI App for iOS versions 6.0.2 and earlier