Flaw in TikTok Android app could have allowed users’ accounts to be hackedSecurity Affairs
Microsoft has discovered a vulnerability in the TikTok app for Android that could lead to a one-click account takeover.
Microsoft researchers have discovered a very serious flaw (CVE-2022-28799) in the TikTok Android app, which could have allowed attackers to hijack user accounts with a single click. Experts say the vulnerability would have required linking with other flaws to hijack an account. Microsoft reported the issue to TikTok in February, and the company quickly fixed it. Microsoft has confirmed that it is not aware of any in-the-wild attacks exploiting the bug.
Experts have determined that the flaw impacts the Android app, which has over 1.5 billion installs through the Google Play Store.
“Attackers could have exploited the vulnerability to hijack an account without users’ knowledge if a targeted user simply clicked on a specially crafted link.” read it Publish published by Microsoft. “Attackers could then have accessed and modified TikTok profiles and users’ sensitive information, such as by posting private videos, sending messages, and uploading videos on behalf of users.”
Microsoft pointed out that by using the exploit to hijack WebView, it is possible to invoke these methods to grant attackers functionality. Some of the exposed methods can allow attackers to access or modify users’ private information, while others can make authenticated HTTP requests to any URL given as a parameter. The method also accepts a set of parameters in the form of a JSON string which can be used to form the body of a POST request and returns the server response including headers.
By calling such methods, an attacker can:
- Retrieve user authentication tokens by initiating a request to a controlled server and saving the cookie and request headers.
“In short, by controlling one of the methods capable of making authenticated HTTP requests, a malicious actor may have compromised a TikTok user account.” concludes the report.
(Security cases – hacking, android)