KuCoin Disclosed Report

KuCoin Mobile Application for Android

Hy team

I identified an open redirect vulnerability in the Android crypto market app while inspecting the app's DEX files. During my investigation, I initially focused on potential issues within the app's WebView. Eventually, I discovered a deep link that, when clicked by the victim, triggered a redirection sequence. The app redirected the victim to a malicious website, following a scenario reminiscent of a new stacking and earning process. This vulnerability poses a potential security threat, warranting attention and remediation

##Vul_deepLink:

kucoin:///external/link?url=https://attacker.io

impact:

The identified open redirect vulnerability in the Android crypto market app can have a significant impact on user security. Exploiting this flaw could lead to unauthorized redirections, potentially exposing users to malicious websites. This creates a heightened risk of phishing attacks, data theft, or other harmful activities. The impact extends beyond the app itself, affecting the trustworthiness of the entire platform and putting users' sensitive information at risk. Immediate attention and remediation are crucial to mitigate these potential consequences.

##Step to reproduce:

1. make file html and use the following code:

<h1>this is GET form</h1><a href="kucoin:///external/link?url=https://attacker.io">Open Deep Link</a>

2. run the file on the browser and click to the link
3. now it will run the malicios website