cve/CVE-2023-42468 at main · actuator/cve · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
The com.cutestudio.colordialer application through 2.1.8-2 for Android
> allows a remote attacker to initiate phone calls without user consent,
> because of improper export of the com.cutestudio.dialer.activities.DialerActivity component.
> A third-party application (without any permissions) can craft an intent targeting
> com.cutestudio.dialer.activities.DialerActivity via the
> android.intent.action.CALL action in conjunction with a tel: URI, thereby
> placing a phone call.
>
> ------------------------------------------
>
>
> [Vulnerability Type]
> Incorrect Access Control
>
> ------------------------------------------
>
> [Vendor of Product]
> AZ Mobile Software
>
> ------------------------------------------
>
> [Affected Product Code Base]
> `com.cutestudio.colordialer` for Android - Version: 2.1.8-2 (220)
>
> ------------------------------------------
>
> [Affected Component]
> The com.cutestudio.dialer.activities.DialerActivity component of the com.cutestudio.colordialer application is improperly exported.
>
> ------------------------------------------
>
> [Attack Type]
> Context-dependent
>
> ------------------------------------------
>
> [Impact Escalation of Privileges]
> true
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> A third-party application can craft an intent targeting
> com.cutestudio.dialer.activities.DialerActivity using the
> android.intent.action.CALL action paired with a tel: URI, thereby
> placing a phone call. The exported nature of this activity lacks any
> verification to authenticate the origin of the intent allowing
> malicious 3rd party apps without any permissions to to place
> unauthorized phone calls without user consent.
>
> ------------------------------------------
>
> [Reference]
> https://github.com/actuator/com.cutestudio.colordialer/blob/main/CWE-284.md
> https://github.com/actuator/com.cutestudio.colordialer/blob/main/dialerPOC.apk
> https://github.com/actuator/com.cutestudio.colordialer/blob/main/dial.gif
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren