The popular call-blocking application Truecaller has recently made it to the news due to a security flaw. A researcher discovered a serious vulnerability in the Truecaller app that could have threatened the security of millions of users.<\/p>\n
Truecaller App Vulnerability Indian security researcher Ehraz Ahmed found a critical vulnerability in the Truecaller app. Specifically, the vulnerability allowed a user to plant a URL into the profile picture.<\/p>\n
Hence, a potential attacker could exploit the flaw to inject a malicious URL to the profile picture. As a result, anyone clicking on the profile would fall a victim to the attack.<\/p>\n
According to Forbes, Ahmed told, The flaw allows an attacker to inject his malicious link as the profile URL. The user viewing the attacker\u2019s profile by search or through a popup gets exploited.<\/p>\n
The researcher revealed that such attacks could allow the attacker to extract numerous details about the user. This includes fetching the victim\u2019s IP address, user-agent and time without them knowing. He has also shared a POC of the exploit demonstrating how an attacker could fetch victim\u2019s information.<\/p>\n