Microsoft 365 Defender researchers in a blog post on Wednesday revealed that they had discovered a ‘high-severity’ vulnerability in the TikTok Android application, which allowed attackers to hijack a user’s account with a single click.
The issue was reported to TikTok in February 2022 through its vulnerability reporting page for which a fix was included in an update released within a month’s time after the initial disclosure.
The high-severity vulnerability, tracked as CVE-2022-28799 with a score of 8.3, and particularly affected TikTok on Android version 23.7.3 and lower, required several issues to be chained together to exploit, and was not used in the wild, according to Microsoft.
“Attackers could have leveraged the vulnerability to hijack an account without users’ awareness if a targeted user simply clicked a specially crafted link,” Microsoft 365 Defender Research Team’s Dimitrios Valsamaras said.
“Attackers could have then accessed and modified users’ TikTok profiles and sensitive information, such as by publicizing private videos, sending messages, and uploading videos on behalf of users.”
This vulnerability when paired with an exploit to hijack WebView could grant functionality to attackers that would allow them to access or modify TikTok users’ private information or perform authenticated HTTP requests to any URL given as a parameter.
By invoking such methods, an attacker can:
- Retrieve the user’s authentication tokens by triggering a request to a controlled server and logging the cookie and the request headers.
“In short, by controlling any of the methods able to perform authenticated HTTP requests, a malicious actor could have compromised a TikTok user account,” said Valsamaras.
TikTok has two versions of its Android app: one for East and Southeast Asia under the package name com.ss.android.ugc.trill, and another for the remaining countries under the package name com.zhiliaoapp.musically. When Microsoft performed a vulnerability assessment, they found both versions of the app for Android were impacted, which have over 1.5 billion installations combined via the Google Play Store.
Microsoft recommends users update their apps to the latest version to protect themselves, avoid loading malicious or untrusted web content, immediately report any abnormal app behavior, and download and install apps only from official sources.