CVE-2021-0537: CertInstaller WifiInstaller Confirmation Dialog Overlay Vulnerability
Summary
CVE-2021-0537: In onCreate of WiFiInstaller.java, there is a possible way to install a malicious Hotspot 2.0 configuration due to a tapjacking/overlay attack. Affects platform/packages/apps/CertInstaller versions >= 11:0, < 11:2021-06-01. Fixed in 11:2021-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CertInstaller is an Android package that handles the installation of certificates and configurations on Android devices. It provides functionality for installing Wi-Fi configurations, including Hotspot 2.0 configurations. The package is a part of the Android ecosystem and is present in Android 11 and earlier versions. The vulnerability in the CertInstaller package allows for a tapjacking/overlay attack during the installation of a Wi-Fi configuration.
Vulnerability Detail
The vulnerability exists in the onCreate function of the WiFiInstaller.java file in the CertInstaller package. An attacker can exploit this vulnerability by overlaying a malicious confirmation dialog on top of the legitimate installation dialog. This can trick the user into installing a malicious Hotspot 2.0 configuration. The attack requires local access to the device and user interaction. Successful exploitation of the vulnerability can lead to a local escalation of privilege, with the attacker gaining user execution privileges.
How To Fix
Minimum fixed version
11:2021-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The CertInstaller package in Android is vulnerable to a tapjacking/overlay attack during the installation of Wi-Fi configurations. This can lead to a local escalation of privilege. It is recommended to update the CertInstaller package to the fixed version released on June 1, 2021, to mitigate the vulnerability.
See every vulnerability recorded for platform/packages/apps/CertInstaller →
FAQ
CertInstaller is an Android package that handles the installation of certificates and configurations on Android devices. It is a part of the Android ecosystem.
The vulnerability allows for a tapjacking/overlay attack during the installation of a Wi-Fi configuration. Successful exploitation can lead to a local escalation of privilege.
Yes, the vulnerability requires user interaction for the overlay attack to be successful.
The vulnerability is present in Android 11 and earlier versions.
Yes, a fix for the vulnerability has been released on June 1, 2021.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/CertInstaller.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
