CVE-2023-51219
📋 TL;DR
A deep link validation vulnerability in KakaoTalk allowed attackers to execute arbitrary JavaScript in WebViews, which could leak access tokens and enable account takeover. This affected KakaoTalk users on vulnerable versions, allowing attackers to read chat messages and potentially compromise accounts.
💻 Affected Systems
- KakaoTalk
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attackers to read all chat messages, send messages as the victim, and access other linked services.
Likely Case
Account compromise leading to unauthorized access to chat history and potential social engineering attacks using the victim's identity.
If Mitigated
Limited impact with proper WebView security controls and token validation in place.
🎯 Exploit Status
Exploitation requires user to click malicious links but doesn't require authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.4.4 and later
Vendor Advisory: https://stulle123.github.io/posts/kakaotalk-account-takeover/
Restart Required: Yes
Instructions:
1. Open app store (Google Play Store or Apple App Store)
2. Search for KakaoTalk
3. Update to version 10.4.4 or later
4. Restart the application
🔧 Temporary Workarounds
Disable automatic link handling
allConfigure device to ask before opening links in KakaoTalk
Use web browser for links
allConfigure KakaoTalk to open links in external browser instead of WebView
🧯 If You Can't Patch
- Disable deep link handling for KakaoTalk in device settings
- Use alternative messaging applications until patch can be applied
🔍 How to Verify
Check if Vulnerable:
Check KakaoTalk version in app settings; if version is 10.4.3 or earlier, it's vulnerableCheck Version:
Open KakaoTalk → Settings → About → Check version numberVerify Fix Applied:
Verify KakaoTalk version is 10.4.4 or later in app settings📡 Detection & Monitoring
Log Indicators:
- Unusual access token requests
- Multiple failed authentication attempts from same token
- Suspicious JavaScript execution in WebView logs
Network Indicators:
- Unusual HTTP requests with access tokens to unexpected domains
- JavaScript injection patterns in network traffic
SIEM Query:
source="kakaotalk" AND (event="token_leak" OR event="javascript_injection")