nvd-json-data-feeds/CVE-2023/CVE-2023-382xx/CVE-2023-38293.json

{
  "id": "CVE-2023-38293",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2024-04-22T15:15:46.820",
  "lastModified": "2024-07-03T01:40:44.480",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Certain software builds for the Nokia C200 and Nokia C100 Android devices contain a vulnerable, pre-installed app with a package name of com.tracfone.tfstatus (versionCode='31', versionName='12') that allows local third-party apps to execute arbitrary AT commands in its context (radio user) via AT command injection due to inadequate access control and inadequate input filtering. No permissions or special privileges are necessary to exploit the vulnerability in the com.tracfone.tfstatus app. No user interaction is required beyond installing and running a third-party app. The software build fingerprints for each confirmed vulnerable device are as follows: Nokia C200 (Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_080:user/release-keys and Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_040:user/release-keys) and Nokia C100 (Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_270:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_190:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_130:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_110:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_080:user/release-keys, and Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_050:user/release-keys). This malicious app sends a broadcast Intent to the receiver component named com.tracfone.tfstatus/.TFStatus. This broadcast receiver extracts a string from the Intent and uses it as an extra when it starts the com.tracfone.tfstatus/.TFStatusActivity activity component which uses the externally controlled string as an input to execute an AT command. There are two different injection techniques to successfully inject arbitrary AT commands to execute."
    },
    {
      "lang": "es",
      "value": "Ciertas versiones de software para los dispositivos Android Nokia C200 y Nokia C100 contienen una aplicaci\u00f3n vulnerable preinstalada con un nombre de paquete de com.tracfone.tfstatus (versionCode='31', versionName='12') que permite aplicaciones locales de terceros. ejecutar comandos AT arbitrarios en su contexto (usuario de radio) mediante la inyecci\u00f3n de comandos AT debido a un control de acceso inadecuado y un filtrado de entrada inadecuado. No se necesitan permisos ni privilegios especiales para explotar la vulnerabilidad en la aplicaci\u00f3n com.tracfone.tfstatus. No se requiere ninguna interacci\u00f3n del usuario m\u00e1s all\u00e1 de instalar y ejecutar una aplicaci\u00f3n de terceros. Las huellas digitales de compilaci\u00f3n de software para cada dispositivo vulnerable confirmado son las siguientes: Nokia C200 (Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_080:user/release-keys and Nokia/Drake_02US/DRK:12/SP1A.210812.016/02US_1_040:user/release-keys) and Nokia C100 (Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_270:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_190:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_130:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_110:user/release-keys, Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_080:user/release-keys, and Nokia/DrakeLite_02US/DKT:12/SP1A.210812.016/02US_1_050:user/release-keys). Esta aplicaci\u00f3n maliciosa env\u00eda una intenci\u00f3n de transmisi\u00f3n al componente receptor llamado com.tracfone.tfstatus/.TFStatus. Este receptor de transmisi\u00f3n extrae una cadena del Intent y la usa como extra cuando inicia el componente de actividad com.tracfone.tfstatus/.TFStatusActivity que usa la cadena controlada externamente como entrada para ejecutar un comando AT. Existen dos t\u00e9cnicas de inyecci\u00f3n diferentes para inyectar con \u00e9xito comandos AT arbitrarios para ejecutar."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW",
          "baseScore": 7.3,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.4
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf",
      "source": "cve@mitre.org"
    }
  ]
}