nvd-json-data-feeds/CVE-2023/CVE-2023-382xx/CVE-2023-38294.json

{
  "id": "CVE-2023-38294",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2024-04-22T15:15:46.877",
  "lastModified": "2024-12-04T17:15:11.070",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Certain software builds for the Itel Vision 3 Turbo Android device contain a vulnerable pre-installed app with a package name of com.transsion.autotest.factory (versionCode='7', versionName='1.8.0(220310_1027)') that allows local third-party apps to execute arbitrary shell commands in its context (system user) due to inadequate access control. No permissions or special privileges are necessary to exploit the vulnerability in the com.transsion.autotest.factory app. No user interaction is required beyond installing and running a third-party app. The vulnerability allows local apps to access sensitive functionality that is generally restricted to pre-installed apps, such as programmatically performing the following actions: granting arbitrary permissions (which can be used to obtain sensitive user data), installing arbitrary apps, video recording the screen, wiping the device (removing the user's apps and data), injecting arbitrary input events, calling emergency phone numbers, disabling apps, accessing notifications, and much more. The confirmed vulnerable software build fingerprints for the Itel Vision 3 Turbo device are as follows: Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V92-20230105:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V86-20221118:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V78-20221101:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V64-20220803:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V61-20220721:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V58-20220712:user/release-keys, and Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V051-20220613:user/release-keys. This malicious app sends a broadcast Intent to the receiver component named com.transsion.autotest.factory/.broadcast.CommandReceiver with the path to a shell script that it creates in its scoped storage directory. Then the com.transsion.autotest.factory app will execute the shell script with \"system\" privileges."
    },
    {
      "lang": "es",
      "value": "Ciertas versiones de software para el dispositivo Android Itel Vision 3 Turbo contienen una aplicaci\u00f3n preinstalada vulnerable con un nombre de paquete com.transsion.autotest.factory (versionCode='7', versionName='1.8.0(220310_1027)') que permite aplicaciones locales de terceros para ejecutar comandos de shell arbitrarios en su contexto (usuario del sistema) debido a un control de acceso inadecuado. No se necesitan permisos ni privilegios especiales para explotar la vulnerabilidad en la aplicaci\u00f3n com.transsion.autotest.factory. No se requiere ninguna interacci\u00f3n del usuario m\u00e1s all\u00e1 de instalar y ejecutar una aplicaci\u00f3n de terceros. La vulnerabilidad permite que las aplicaciones locales accedan a funciones confidenciales que generalmente est\u00e1n restringidas a aplicaciones preinstaladas, como realizar mediante programaci\u00f3n las siguientes acciones: otorgar permisos arbitrarios (que pueden usarse para obtener datos confidenciales del usuario), instalar aplicaciones arbitrarias, grabar videos de la pantalla. , borrar el dispositivo (eliminar las aplicaciones y los datos del usuario), inyectar eventos de entrada arbitrarios, llamar a n\u00fameros de tel\u00e9fono de emergencia, deshabilitar aplicaciones, acceder a notificaciones y mucho m\u00e1s. Las huellas digitales de compilaci\u00f3n de software vulnerable confirmadas para el dispositivo Itel Vision 3 Turbo son las siguientes: Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V92-20230105:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V86-20221118:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V78-20221101:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V64-20220803:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V61-20220721:user/release-keys, Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V58-20220712:user/release-keys, and Itel/F6321/itel-S661LP:11/RP1A.201005.001/GL-V051-20220613:user/release-keys. Esta aplicaci\u00f3n maliciosa env\u00eda una intenci\u00f3n de transmisi\u00f3n al componente receptor llamado com.transsion.autotest.factory/.broadcast.CommandReceiver con la ruta a un script de shell que crea en su directorio de almacenamiento de alcance. Luego, la aplicaci\u00f3n com.transsion.autotest.factory ejecutar\u00e1 el script de shell con privilegios de \"sistema\"."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.tecno.com/SRC/blogdetail/99?lang=en_US",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.tecno.com/SRC/blogdetail/99?lang=en_US",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}