Loading HuntDB...

com.duckduckgo.mobile.android - Cache corruption

Medium
D
DuckDuckGo
Submitted None
Reported by webklex

Vulnerability Details

Technical details and impact analysis

Business Logic Errors
## Summary: By opening a special url, the app cache can be corrupted which can't be resolved by the user without reinstalling the app. ## Steps To Reproduce: 1.) Download and install the DuckDuckGo App 2.) Open `https://%22t.dev/` 3.) Try to reopen the app (The app keeps crashing) ## Additional information - Tested on Android 8.1 and 9 with the latest app release (5.73.0) - Problematic seems to be the encoded `"` (%22) ## Mitigation - Store the url urlencoded ## Impact An attacker can corrupt someones app cache and prevent the user from continuing using the app.

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Submitted

Weakness

Business Logic Errors