An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version.
References
| Link | Resource |
|---|---|
| https://kaios.dev/cve/1410290 | Exploit Vendor Advisory |
| https://kaios.dev/cve/1410290 | Exploit Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://kaios.dev/cve/1410290 - Exploit, Vendor Advisory |
30 May 2023, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CPE | cpe:2.3:o:kaiostech:kaios:3.0:*:*:*:*:*:*:* cpe:2.3:o:kaiostech:kaios:3.1:*:*:*:*:*:*:* |
|
| First Time |
Kaiostech kaios
Kaiostech |
|
| CWE | CWE-668 | |
| References | (MISC) https://kaios.dev/cve/1410290 - Exploit, Vendor Advisory |
Information
Published : 2023-05-22 16:15
Updated : 2024-11-21 08:05
NVD link : CVE-2023-33293
Mitre link : CVE-2023-33293
CVE.ORG link : CVE-2023-33293
JSON object : View
Products Affected
kaiostech
- kaios
CWE
CWE-668
Exposure of Resource to Wrong Sphere