CVE-2024-35298
📋 TL;DR
This vulnerability allows malicious Android apps to trick the ZOZOTOWN shopping app into opening arbitrary websites via custom URL schemes. Attackers could exploit this to launch phishing attacks against users. Only Android users with ZOZOTOWN versions before 7.39.6 are affected.
💻 Affected Systems
- ZOZOTOWN Android App
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to sophisticated phishing sites that steal login credentials, payment information, or install malware through social engineering.
Likely Case
Users are tricked into visiting fake ZOZOTOWN or payment pages that harvest credentials or personal information.
If Mitigated
With proper app permissions and user awareness, impact is limited to annoyance from unwanted browser redirects.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but is technically simple for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.39.6
Vendor Advisory: https://jvn.jp/en/jp/JVN37818611/
Restart Required: No
Instructions:
1. Open Google Play Store 2. Search for ZOZOTOWN 3. Tap Update button 4. Verify version is 7.39.6 or higher
🔧 Temporary Workarounds
Disable app links handling
androidPrevent ZOZOTOWN from handling custom URL schemes
Android Settings > Apps > ZOZOTOWN > Open by default > Clear defaults
🧯 If You Can't Patch
- Uninstall ZOZOTOWN app and use web browser version instead
- Install reputable mobile security app to detect malicious applications
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > ZOZOTOWN > App infoCheck Version:
Not applicable - check via Android UIVerify Fix Applied:
Confirm version is 7.39.6 or higher in app settings📡 Detection & Monitoring
Log Indicators:
- Unexpected URL scheme launches from other apps to ZOZOTOWN
Network Indicators:
- ZOZOTOWN app connecting to non-zozo.co.jp domains
SIEM Query:
Not applicable for mobile app vulnerability