CVE-2021-39702: Set Credential Manager App without User Consent in platform/packages/apps/Settings
Summary
CVE-2021-39702: In onCreate of RequestManageCredentials.java, there is a possible way for a third party app to install certificates without user approval due to a tapjacking/overlay attack. Affects platform/packages/apps/Settings across 2 version ranges.
>= 12:0, < 12:2022-03-01
>= 12L:0, < 12L:2022-03-01
Fixed in 12:2022-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/packages/apps/Settings package is a part of the Android ecosystem and is responsible for managing various system settings on Android devices. It provides a user interface for users to configure device settings, including network, display, sound, and security settings. This package is an integral part of the Android operating system and is present on all Android devices. However, a vulnerability has been identified in this package that allows a third-party app to install certificates without user approval.
Vulnerability Detail
The vulnerability, identified as CVE-2021-39702, exists in the RequestManageCredentials.java file of the platform/packages/apps/Settings package. In the onCreate method of this file, there is a potential vulnerability that can be exploited through a tapjacking/overlay attack. This attack allows a malicious app to overlay its own user interface on top of the Settings app, tricking the user into granting permission to install certificates without their knowledge or consent. This can lead to a local escalation of privilege, where the malicious app gains elevated privileges on the device. Exploiting this vulnerability requires user interaction.
How To Fix
Minimum fixed version
12:2022-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can protect themselves by being cautious while granting permissions to apps and avoiding installing apps from untrusted sources. Additionally, keeping the Android operating system and all installed apps up to date can help mitigate the risk of exploitation.
Conclusion
The vulnerability in the platform/packages/apps/Settings package allows a third-party app to install certificates without user approval, leading to a local escalation of privilege. To mitigate this vulnerability, it is crucial to update the package to the latest version available. Additionally, users should exercise caution while granting permissions to apps and avoid installing apps from untrusted sources. Regularly updating the Android operating system and all installed apps is also recommended. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for platform/packages/apps/Settings →
FAQ
This vulnerability allows a malicious app to install certificates without user approval, potentially leading to a local escalation of privilege. The malicious app can gain elevated privileges on the device, which can be used for various malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your device is affected by this vulnerability. Simply enter your application's gradle.lockfile and the playground will analyze it for any open-source vulnerabilities, including this one.
There is no specific evidence mentioned in the vulnerability details. However, it is always recommended to stay updated with the latest security patches and follow best practices to minimize the risk of exploitation.
No, this vulnerability requires user interaction for exploitation. The user needs to grant permission to the malicious app for installing certificates.
If you suspect that your device has been compromised, it is recommended to perform a factory reset to remove any potentially malicious apps or certificates. Additionally, consider changing passwords for sensitive accounts and enable two-factor authentication for added security.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Settings.
