Improper Authorization in Groww Stock App WebView URL Handler

Executive Summary

The vulnerability exists in the Groww Stock, Mutual Fund, Gold App on Android, specifically in the WebView URL Handler component. It allows improper authorization when handling custom URL schemes, which means that an attacker could manipulate the app to load arbitrary URLs or execute unauthorized actions within the WebView.

Exploitation requires physical access to the device and is considered complex and difficult. The vulnerability can be triggered on a physical device, and the exploit code is publicly available.

Additionally, security testing revealed that the app's internal WebView could load arbitrary external URLs when accessed via privileged debugging environments, allowing JavaScript execution and communication with external servers. There is also a weakness in client-side app lock enforcement, where passcodes are not re-validated after activity transitions, potentially allowing unauthorized navigation within the app.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with physical access or debugging privileges to manipulate the app's WebView to load malicious URLs, execute JavaScript, and communicate with external servers. This could lead to phishing or UI redressing attacks.

However, no direct server-side authentication bypass or account compromise has been observed. The impact is limited by the requirement for physical device access or privileged debugging, making exploitation difficult.

The weak client-side app lock enforcement could allow unauthorized users to navigate into sensitive parts of the app without re-entering the passcode, increasing the risk of unauthorized access to app features.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsafe WebView URL handling and weak client-side app lock enforcement in the Groww Android application, which can be exploited only with physical device access or privileged debugging (ADB). Detection would focus on monitoring WebView activities and app lock enforcement behavior.

To detect this vulnerability on your system, you can check if the Groww app's WebView component loads arbitrary external URLs, especially when debugging is enabled. Also, verify if the app lock re-validates passcodes after activity transitions.

• Use ADB commands to monitor WebView URL loading, for example: adb shell dumpsys activity activities | grep WebView
• Check for debugging enabled on the device: adb shell getprop ro.debuggable
• Attempt to navigate within the app after unlocking once to see if passcode re-validation is enforced.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting the WebView URL loading to trusted domains only and enforcing stricter passcode validation within the app.

Additionally, disable debugging (ADB) on physical devices to prevent exploitation via privileged debugging environments.

Ensure that the client-side app lock re-validates passcodes after activity transitions to prevent unauthorized navigation.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0