EcoOnline EHS Android App Information Disclosure and Code Execution

Executive Summary

This vulnerability is a deep link validation bypass in the EcoOnline EHS Android app (version 0.2.499). It allows remote attackers to bypass domain checks and load malicious web content within the trusted app by exploiting improper handling of custom schemes like 'ehs-app://'. The app rewrites these schemes to 'https://' without validating the host, enabling phishing attacks via fake login pages.

Useful 0 Not Useful 0

Detection Guidance

Check if the installed version of EcoOnline EHS Android app is below 0.2.500. Inspect the app's deep link handling by reviewing AndroidManifest.xml for improper intent filters or missing domain validation. Monitor network traffic for suspicious ehs-app:// deep links redirecting to external domains.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick you into clicking a malicious link, causing the app to display a fake login page under their control. If you enter credentials, the attacker could steal them. The vulnerability also allows execution of arbitrary code within the app's context.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using the app may face compliance breaches if user credentials or sensitive data are exposed due to the flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Update the EcoOnline EHS Android app to version 0.2.500 or later immediately. Disable deep link handling for untrusted sources if possible. Educate users to avoid clicking suspicious links in emails or messages. Monitor for phishing attempts exploiting this flaw.

Useful 0 Not Useful 0