GCVE-1988-2026-0243

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Alipay DeepLink+JSBridge Attack",
          "vendor": "Ant Group (蚂蚁集团) / Alibaba Group",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Feng Ning via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Subject: Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)\n\n# Alipay DeepLink + JSBridge Attack Chain\n# Silent GPS Exfiltration via Crafted URL\n\n## Overview\n\nResearcher: Jiqiang Feng / Innora AI Security Research\nVendor: Ant Group (蚂蚁集团) / Alibaba Group\nProduct: Alipay (支付宝) v10.x (Android & iOS)\nUsers Affected: 1 billion+\nCVEs: 6 submitted to MITRE CNA-LR (2026-03-12)\nCVSS: 7.4–9.3\nVendor Response: \"Normal functionality\"\nDisclosure: Responsible (Feb 25 → Mar 11 public)\n\n## Vulnerability Chain\n\nA single crafted URL triggers the following attack chain:\n\n1. Open Redirect (CWE-601): ds.alipay.com/?scheme= accepts arbitrary URL parameters, redirecting to Alipay app via deep \nlink\n2. Whitelist Bypass (CWE-939): ds.alipay.com is a whitelisted Alipay domain, so the deep link handler trusts the \nredirect target\n3. WebView Loading: Attacker-controlled page loads in Alipay's privileged WebView with JSBridge access\n4. API Abuse: AlipayJSBridge.call() exposes sensitive native APIs without user consent\n\n## Exploitable APIs (Verified)\n\n| # | API | Data Extracted | Android | iOS |\n|---|-----|---------------|---------|-----|\n| 1 | getLocation | GPS coords (8.8m accuracy) | ✓ | ✓ |\n| 2 | getNetworkType | WiFi/cellular, carrier info | ✓ | ✓ |\n| 3 | getSystemInfo | Device model, OS, screen | ✓ | ✓ |\n| 4 | getCameraPermission | Camera auth status | ✓ | ✓ |\n| 5 | getMicrophonePermission | Mic auth status | ✓ | ✓ |\n| 6 | tradePay | Pre-fill payment screen | ✗ | ✓ |\n| 7 | share | Trigger share dialog | ✗ | ✓ |\n| 8 | scan | Activate QR scanner | ✗ | ✓ |\n| 9 | chooseImage | Access photo picker | ✗ | ✓ |\n\niOS attack surface is significantly larger than Android.\n\n## PoC\n\nTrigger URL pattern:\nhttps://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067&url=[BASE64_ENCODED_ATTACKER_URL]\n\nVerification page (read-only, no data collection):\nhttps://innora.ai/zfb/poc/trigger.html\n\n## Verification\n\n- 3 devices: Samsung S25 Ultra (NZ), Xiaomi Redmi 12 (MY), iPhone 16 Pro (CN-Hangzhou)\n- 308 server-side exfiltration logs\n- 42 screenshots\n- Vendor's own security lead tested on iPhone from Hangzhou (Alipay HQ) — GPS captured silently in 7 seconds, accuracy \n8.8m\n\n## Timeline\n\n2026-02-25: Initial TLS/SSL report to vendor\n2026-03-06: Vendor: \"cannot be practically exploited\"\n2026-03-07: Expanded report (17 vulns, full E2E proof)\n2026-03-07: Whitelist bypass achieved in 2 min during live call with vendor\n2026-03-08: Vendor's security lead's iPhone tested from Hangzhou — GPS captured\n2026-03-10: Vendor final: \"normal functionality\"\n2026-03-11: Public disclosure\n2026-03-11: Vendor's law firm files takedown complaint (4 hours later)\n2026-03-12: 6 CVEs submitted to MITRE\n\n## Full Report\n\nhttps://innora.ai/zfb/ (bilingual EN/ZH)\n\n## Notes\n\n- Alibaba is a registered CNA (CNA-2017-0006) but refused to assign CVEs\n- Vendor's law firm complaint targets an article that never once mentions \"Alipay\" or \"Ant Group\" by name\n- Vendor's security contact privately called it a \"洞\" (hole/vuln) while officially classifying as \"normal functionality\"\n\n## Contact\n\nJiqiang Feng | feng () innora ai | Innora AI Security Research\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-939",
              "description": "CWE-939",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:40:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/4"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Mar/4"
        },
        {
          "url": "https://ds.alipay.com/?scheme=alipays://platformapi/startapp?appId=20000067&url=[BASE64_ENCODED_ATTACKER_URL"
        },
        {
          "url": "https://innora.ai/zfb/"
        },
        {
          "url": "https://innora.ai/zfb/poc/trigger.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Mar/4"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Alipay DeepLink+JSBridge Attack Chain: Silent GPS Exfiltration, 17 Vulns, 6 CVEs (CVSS 9.3)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0243",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/4",
            "automated": true,
            "contentSha256": "c41650b65f5b5e3df47a5c82a69ed945e38f06dd504335c7dd62cf305b8c4dde",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/4",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-03-12T02:33:20Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T08:13:41Z",
    "dateUpdated": "2026-09-09T13:40:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0243"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}