A high-severity vulnerability in the popular TikTok app for Android, which has received over 1.5 billion downloads from the Play store, allows for one-click account takeover.
Users are urged to update their apps to Version 23.7.3 or higher by TikTok.
The entry for the bug in Common Vulnerabilities and Exposures is as brief as possible.
“The TikTok app for Android prior to version 23.7.3 facilitates account takeover. The com.zhiliaoapp.musically WebView may be forced to load any website by a specially constructed URL (unvalidated deeplink). This might make it possible for a hacker to quickly take over a JavaScript interface that is attached.
More information on Microsoft’s discovery was provided in a blog post.
“The flaw made it possible to avoid the deeplink verification in the app, “Google noted.
“Attackers might cause the app to load any URL to its WebView, which would then enable the attackers to access the WebView’s associated JavaScript bridges.
According to the article, the WebView component offers JavaScript interfaces and “enables applications to load and display web pages as well as provide bridge functionality that allows JavaScript code in the web page to invoke specific Java methods of a particular class in the app using the addJavascriptInterface API call.”