Shinrays Games Goods Triple App Exposed Hard-Coded Cryptographic Key Vulnerability

A vulnerability exists in Shinrays Games Goods Triple App, specifically in the Cats Goods Sort component, version 1.200. The issue arises from an unknown function in the file jRwTX.java, where a hard-coded AES key and initialization vector (IV) are embedded. This vulnerability allows attackers to extract these static values through reverse engineering, potentially enabling them to decrypt sensitive server responses, such as AppsFlyer attribution data. The vulnerability requires local exploitation and is considered complex, although a public exploit is available.

Impact

The hard-coded cryptographic key and IV can be extracted and used to decrypt sensitive information, potentially leading to unauthorized access to confidential data.