CVE-2024-45203
📋 TL;DR
This vulnerability allows attackers to redirect users to arbitrary websites through the @cosme app's custom URL scheme, potentially leading to phishing attacks. It affects Android versions before 5.69.0 and iOS versions before 6.74.0 of the @cosme app.
💻 Affected Systems
- @cosme App for Android
- @cosme App for iOS
📦 What is this software?
\@cosme by Istyle
\@cosme by Istyle
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to sophisticated phishing sites that steal login credentials, payment information, or install malware, leading to account compromise and financial loss.
Likely Case
Users are redirected to phishing pages attempting to steal @cosme account credentials or personal information through deceptive login forms.
If Mitigated
With updated app versions, the URL scheme properly validates destinations, preventing unauthorized redirects and maintaining user security.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but is technically simple once the malicious URL is crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android: 5.69.0+, iOS: 6.74.0+
Vendor Advisory: https://jvn.jp/en/jp/JVN81570776/
Restart Required: No
Instructions:
1. Open Google Play Store (Android) or App Store (iOS). 2. Search for '@cosme'. 3. Update to version 5.69.0 or higher (Android) or 6.74.0 or higher (iOS).
🔧 Temporary Workarounds
Disable app links handling
allPrevent the @cosme app from opening custom URL schemes by disabling its link handling in system settings.
🧯 If You Can't Patch
- Uninstall the vulnerable @cosme app versions until updates can be applied.
- Educate users to avoid clicking unknown links, especially those claiming to be from @cosme.
🔍 How to Verify
Check if Vulnerable:
Check app version in settings: Android: Settings > Apps > @cosme > App info; iOS: Settings > @cosme.Check Version:
Not applicable; use GUI method above.Verify Fix Applied:
Confirm app version is Android 5.69.0+ or iOS 6.74.0+ using the same method.📡 Detection & Monitoring
Log Indicators:
- Unusual redirect patterns in app logs or web proxy logs pointing to @cosme URL schemes.
Network Indicators:
- HTTP requests from the app to unexpected domains shortly after app launch or link clicks.
SIEM Query:
Not applicable due to app-specific nature; monitor for user reports of phishing via @cosme links.