According to Forbes, Ahmed told,
The flaw allows an attacker to inject his malicious link as the profile URL. The user viewing the attacker’s profile by search or through a popup gets exploited.The researcher revealed that such attacks could allow the attacker to extract numerous details about the user. This includes fetching the victim’s IP address, user-agent and time without them knowing.
He has also shared a POC of the exploit demonstrating how an attacker could fetch victim’s information.
It was recently brought to our attention that there was a small bug in our app services which allowed the modification of one's own profile in an unintended way. We thank the security researcher for bringing this to our notice and collaborating with us. The bug was immediately fixed.Since it’s a critical bug affecting all Truecaller applications, users must ensure they update their devices with the latest patched versions.
Alongside the fix, Truecaller has also disclosed its plans to announce a bug bounty program soon.
Let us know your thoughts in the comments.
