CVE-2024-41918
📋 TL;DR
The Rakuten Ichiba mobile apps for Android and iOS contain an improper authorization vulnerability in their custom URL scheme handlers. This allows other installed apps to launch arbitrary websites within the app's WebView, potentially redirecting users to phishing sites. Users of Rakuten Ichiba Android version 12.4.0 and earlier or iOS version 11.7.0 and earlier are affected.
💻 Affected Systems
- Rakuten Ichiba App for Android
- Rakuten Ichiba App for iOS
📦 What is this software?
Ichiba by Rakuten
Ichiba by Rakuten
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to sophisticated phishing sites that steal login credentials, payment information, or install malware through the app's trusted context.
Likely Case
Users are redirected to phishing sites attempting to steal Rakuten account credentials or payment information through the app's WebView.
If Mitigated
With proper URL validation and authorization checks, only legitimate Rakuten URLs would be allowed, preventing external manipulation.
🎯 Exploit Status
Exploitation requires user to have a malicious app installed that can trigger the vulnerable URL scheme. No authentication needed for the attack itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android: 12.4.1+, iOS: 11.7.1+
Vendor Advisory: https://jvn.jp/en/jp/JVN56648919/
Restart Required: No
Instructions:
1. Open Google Play Store or Apple App Store. 2. Search for 'Rakuten Ichiba'. 3. Update to latest version (Android 12.4.1+ or iOS 11.7.1+). 4. No restart required after update.
🔧 Temporary Workarounds
Uninstall suspicious apps
allRemove any unfamiliar or untrusted apps that could exploit the vulnerability
Disable app links/URL handling
allIn Android/iOS settings, disable the Rakuten app from opening links (temporary workaround)
🧯 If You Can't Patch
- Uninstall the Rakuten Ichiba app until patched version is available
- Use Rakuten website instead of mobile app for shopping activities
🔍 How to Verify
Check if Vulnerable:
Check app version in device settings: Android: Settings > Apps > Rakuten Ichiba > App info; iOS: Settings > General > iPhone Storage > Rakuten IchibaCheck Version:
Not applicable - check via device settings as describedVerify Fix Applied:
Verify app version is Android 12.4.1+ or iOS 11.7.1+ after update📡 Detection & Monitoring
Log Indicators:
- Unusual URL scheme activations from other apps
- WebView loading non-Rakuten domains
Network Indicators:
- App connecting to unexpected domains through WebView
- HTTPS traffic to non-Rakuten shopping/phishing sites
SIEM Query:
Not applicable for typical mobile app deployment