com.duckduckgo.mobile.android - Cache corruption
Medium
D
DuckDuckGo
Submitted None
Actions:
Reported by
webklex
Vulnerability Details
Technical details and impact analysis
## Summary:
By opening a special url, the app cache can be corrupted which can't be resolved by the user without reinstalling the app.
## Steps To Reproduce:
1.) Download and install the DuckDuckGo App
2.) Open `https://%22t.dev/`
3.) Try to reopen the app (The app keeps crashing)
## Additional information
- Tested on Android 8.1 and 9 with the latest app release (5.73.0)
- Problematic seems to be the encoded `"` (%22)
## Mitigation
- Store the url urlencoded
## Impact
An attacker can corrupt someones app cache and prevent the user from continuing using the app.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Business Logic Errors