SB2021071412 - Multiple vulnerabilities in Retty App

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization in Handler for Custom URL Scheme (CVE-ID: CVE-2021-20747)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected app is launched by Custom URL Scheme. A remote attacker can trick a victim to access an arbitrary URL. 

2) Use of hard-coded credentials (CVE-ID: CVE-2021-20748)

The vulnerability allows a local attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code. A local attacker can analyze the data in the App and obtain the API key for external services.

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/jp/JVN26891339/index.html
• https://drive.google.com/file/d/1PBYqIsK8QxEEhGJ4SEgpY7iZw3RTTDho/view