Description
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Docile-Alligator Infinity for Reddit
Default version status: unaffected
0 to ≤ 8.3.4affected
References
- https://github.com/Docile-Alligator/Infinity-For-Reddit/issues/1975 ↗
- https://github.com/Docile-Alligator/Infinity-For-Reddit ↗
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/activities/LoginChromeCustomTabActivity.java#L194-L205 ↗
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/utils/APIUtils.java#L43 ↗
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/AndroidManifest.xml#L75-L92 ↗
- https://www.vulncheck.com/advisories/infinity-for-reddit-through-8.3.4-oauth-login-csrf-via-loginchromecustomtabactivity ↗