PropertyGuru AgentNet Singapore Hard-Coded Segment Write Key Vulnerability

A vulnerability exists in the PropertyGuru AgentNet Singapore App for Android, in versions prior to 23.7.10. The issue arises from hard-coded Segment write keys found in the BuildConfig.java file of the com.allproperty.android.agentnet component. This vulnerability allows local attackers to extract the keys through reverse engineering and use them to send arbitrary tracking events or modify user profiles via Segment's API. Such exploitation could inject fraudulent analytics data, corrupt business intelligence, disrupt user segmentation, and misuse downstream systems that rely on this data.

Impact

Exploitation of this vulnerability could lead to unauthorized injection of analytics data, manipulation of user profiles, and potential disruption of business intelligence processes and systems.