Improper Authorization in Moovit Bus & Public Transit App

Executive Summary

This vulnerability is a flaw found in the Moovit Bus & Public Transit App version 1.18 on Android. It affects an unknown part of the component com.tranzmate. The issue arises from improper authorization handling in the handler for a custom URL scheme. This means that an attacker could manipulate the app locally to bypass authorization checks.

The attack can only be executed locally, and the exploit has already been published and may be used by attackers. The vendor was contacted early about this issue but did not respond.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to improper authorization, which means an attacker with local access to the device could potentially perform actions or access data that should be restricted. This could result in limited confidentiality, integrity, and availability impacts on the app's data or functionality.

According to the CVSS v3.1 score of 5.3, the impact is moderate, affecting confidentiality, integrity, and availability to a limited extent.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the Moovit Android application allows attacker-controlled web content to be rendered within the app's trusted interface, enabling phishing attacks, UI spoofing, and user deception.

Such exploitation could lead to credential theft and erosion of user trust, which may impact compliance with data protection regulations like GDPR and HIPAA that require safeguarding user data and preventing unauthorized access.

However, the provided information does not explicitly state the direct impact on compliance with these standards or any regulatory consequences.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Moovit Android app's exported and browsable WebView activity (com.moovit.web.WebViewActivity) improperly handling externally supplied URLs via crafted intents or malicious deep links.

To detect this vulnerability on your system, you can check if the Moovit app has the vulnerable exported WebView activity enabled and if it accepts external intents with URLs without proper validation.

Suggested commands include using Android Debug Bridge (adb) to inspect the app's exported activities and intent filters:

• adb shell dumpsys package moovit | grep -A 10 'com.moovit.web.WebViewActivity'
• adb shell pm dump moovit | grep -i 'intent-filter'

Additionally, you can attempt to send crafted intents to the activity to see if it processes arbitrary URLs without restrictions:

• adb shell am start -a android.intent.action.VIEW -d 'malicious_url_scheme://example.com' com.moovit/.web.WebViewActivity

Monitoring app behavior for unexpected WebView loads or suspicious URL handling can also help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling or restricting the exported WebView activity (com.moovit.web.WebViewActivity) if possible.

Implement strict domain allowlisting and URL validation to ensure only trusted URLs are processed by the WebView.

Restrict or disable handling of dangerous or custom URL schemes that could be exploited.

If you are an end user, avoid installing or running untrusted apps that could send malicious intents to the Moovit app.

Consider opening untrusted content in external browsers rather than within the app's WebView.

Since the vendor has not responded, monitor for updates or patches and apply them as soon as they become available.

Useful 0 Not Useful 0