CVE-2023-38290

{"id": "CVE-2023-38290", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-04-22T15:15:46.657", "references": [{"url": "https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1263"}]}], "descriptions": [{"lang": "en", "value": "Certain software builds for the BLU View 2 and Sharp Rouvo V Android devices contain a vulnerable pre-installed app with a package name of com.evenwell.fqc (versionCode='9020801', versionName='9.0208.01' ; versionCode='9020913', versionName='9.0209.13' ; versionCode='9021203', versionName='9.0212.03') that allows local third-party apps to execute arbitrary shell commands in its context (system user) due to inadequate access control. No permissions or special privileges are necessary to exploit the vulnerability in the com.evenwell.fqc app. No user interaction is required beyond installing and running a third-party app. The vulnerability allows local apps to access sensitive functionality that is generally restricted to pre-installed apps, such as programmatically performing the following actions: granting arbitrary permissions (which can be used to obtain sensitive user data), installing arbitrary apps, video recording the screen, wiping the device (removing the user's apps and data), injecting arbitrary input events, calling emergency phone numbers, disabling apps, accessing notifications, and much more. The software build fingerprints for each confirmed vulnerable device are as follows: BLU View 2 (BLU/B131DL/B130DL:11/RP1A.200720.011/1672046950:user/release-keys, BLU/B131DL/B130DL:11/RP1A.200720.011/1663816427:user/release-keys, BLU/B131DL/B130DL:11/RP1A.200720.011/1656476696:user/release-keys, BLU/B131DL/B130DL:11/RP1A.200720.011/1647856638:user/release-keys) and Sharp Rouvo V (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_460:user/release-keys and SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys). This malicious app starts an exported activity named com.evenwell.fqc/.activity.ClickTest, crashes the com.evenwell.fqc app by sending an empty Intent (i.e., having not extras) to the com.evenwell.fqc/.FQCBroadcastReceiver receiver component, and then it sends command arbitrary shell commands to the com.evenwell.fqc/.FQCService service component which executes them with \"system\" privileges."}, {"lang": "es", "value": "Ciertas versiones de software para los dispositivos Android BLU View 2 y Sharp Rouvo V contienen una aplicaci\u00f3n preinstalada vulnerable con un nombre de paquete com.evenwell.fqc (versionCode='9020801', versionName='9.0208.01'; versionCode='9020913 ', versionName='9.0209.13' ; versionCode='9021203', versionName='9.0212.03') que permite que aplicaciones locales de terceros ejecuten comandos de shell arbitrarios en su contexto (usuario del sistema) debido a un control de acceso inadecuado. No se necesitan permisos ni privilegios especiales para explotar la vulnerabilidad en la aplicaci\u00f3n com.evenwell.fqc. No se requiere ninguna interacci\u00f3n del usuario m\u00e1s all\u00e1 de instalar y ejecutar una aplicaci\u00f3n de terceros. La vulnerabilidad permite que las aplicaciones locales accedan a funciones confidenciales que generalmente est\u00e1n restringidas a aplicaciones preinstaladas, como realizar mediante programaci\u00f3n las siguientes acciones: otorgar permisos arbitrarios (que pueden usarse para obtener datos confidenciales del usuario), instalar aplicaciones arbitrarias, grabar videos de la pantalla, borrar el dispositivo (eliminar las aplicaciones y los datos del usuario), inyectar eventos de entrada arbitrarios, llamar a n\u00fameros de tel\u00e9fono de emergencia, deshabilitar aplicaciones, acceder a notificaciones y mucho m\u00e1s. Las huellas digitales de compilaci\u00f3n de software para cada dispositivo vulnerable confirmado son las siguientes: BLU View 2 (BLU/B131DL/B130DL:11/RP1A.200720.011/1672046950:user/release-keys, BLU/B131DL/B130DL:11/RP1A.200720.011/1663816427:user/release-keys, BLU/B131DL/B130DL:11/RP1A.200720.011/1656476696:user/release-keys, BLU/B131DL/B130DL:11/RP1A.200720.011/1647856638:user/release-keys) y Sharp Rouvo V (SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_460:user/release-keys and SHARP/VZW_STTM21VAPP/STTM21VAPP:12/SP1A.210812.016/1KN0_0_530:user/release-keys). Esta aplicaci\u00f3n maliciosa inicia una actividad exportada llamada com.evenwell.fqc/.activity.ClickTest, bloquea la aplicaci\u00f3n com.evenwell.fqc enviando un Intent vac\u00edo (es decir, sin extras) al receptor com.evenwell.fqc/.FQCBroadcastReceiver componente, y luego env\u00eda comandos de shell arbitrarios al componente de servicio com.evenwell.fqc/.FQCService que los ejecuta con privilegios de \"sistema\"."}], "lastModified": "2024-07-03T01:40:42.817", "sourceIdentifier": "cve@mitre.org"}