Meesho Android App Unsecured Storage of PII and Auth Tokens in SharedPreferences

Vulnerability Overview The Meesho Android application ( ) contains an issue where sensitive user data is exposed via insecure storage. Dynamic analysis reveals that Personally Identifiable Information (PII) such as phone numbers, email addresses, full names, user IDs, and detailed session data are stored in plaintext within . Scope of Impact Affected Application: Meesho - Resell & Earn Package Name: Platform: Android Vulnerability Type: Insecure Storage of Sensitive Information Component: Affected Keys: , , , etc. Security Impact An attacker with physical access to the device can: Extract complete user identity information (phone number, email address, full name, user ID). Access detailed user behavior and device profile data. Retrieve session and authentication-related information. Potential consequences include privacy breaches and identity theft, targeted phishing or social engineering attacks, and account enumeration. Attack Requirements Physical access to the target Android device. Frida or an equivalent dynamic instrumentation tool. Vulnerability Details CWE Classification: - CWE-312: Cleartext Storage of Sensitive Information - CWE-359: Exposure of Private Personal Information - CWE-922: Insecure Storage of Sensitive Information CVSS v3.1 Score (Estimated): 6.2 – 7.1 (Medium-High) Attack Vector: Physical Attack Complexity: Low Required Privileges: None User Interaction: None Scope: Unchanged Confidentiality: High Reproduction Steps Using Frida (Dynamic Analysis) 1. Save the following script as : 2. Run the Frida command: 3. Interact with the application normally (log in, browse products, view account sections, etc.). 4. Observe the real-time logs showing exposed PII and sensitive data. Root Cause Sensitive PII and session data are stored in plaintext in . or Android Keystore is not utilized. Excessive local persistence of user and analytics data. Remediation 1. Use with (AES256_GCM). 2. Store highly sensitive data (tokens, PII) in the Android Keystore. 3. Minimize unnecessary PII storage and implement appropriate data masking. 4. Review and restrict what is written to . Severity Assessment Severity: Medium-High (due to direct exposure of PII) Disclosure Timeline June 2026: Vulnerability discovered during security research. June 2026: Reported to the Meesho security team. TBD: Vendor response/patch. TBD: CVE assignment. TBD: Public disclosure. Proof of Concept Media Frida script: (included above). Screenshots and full logs available upon request. Credits Researcher: Soyam Arya Alias: honest_corrupt GitHub: https://github.com/honestcorrupt Disclaimer This research was conducted entirely in a controlled testing environment, using the researcher's own accounts and personal devices. No access to or storage of real user data belonging to others occurred. All tests were performed in accordance with responsible disclosure principles.

Goal Reached Thanks to every supporter — we hit 100%!

Meesho Android App Unsecured Storage of PII and Auth Tokens in SharedPreferences

More from this source