CVE-2022-20467: Bypassing check of isBluetoothShareUri to force Bluetooth app to grant its accessible ContentProviders' access
Summary
CVE-2022-20467: In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. Affects platform/packages/modules/Bluetooth across 2 version ranges.
>= 13:0, < 13:2023-03-01
>= 13-next:0, < 13-next:2023-03-01
Fixed in 13-next:2023-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is 'platform/packages/modules/Bluetooth' in the Android ecosystem. This package is responsible for handling Bluetooth functionality on Android devices. It provides APIs and services for Bluetooth communication, including file sharing between devices. The vulnerability in this package allows an attacker to bypass the check of 'isBluetoothShareUri' and force the Bluetooth app to grant access to its accessible ContentProviders.
Vulnerability Detail
The vulnerability arises from a confused deputy scenario in the 'isBluetoothShareUri' function of 'BluetoothOppUtility.java'. By exploiting this vulnerability, an attacker can perform an incorrect file read, leading to local information disclosure. This can be achieved without requiring any additional execution privileges. However, user interaction is necessary for successful exploitation of the vulnerability.
How To Fix
Minimum fixed version
13-next:2023-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the 'platform/packages/modules/Bluetooth' package in the Android ecosystem is vulnerable to a bypassing check vulnerability. This can lead to local information disclosure if exploited. Developers should update their applications to the fixed version released on or after March 1, 2023, to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/packages/modules/Bluetooth →
FAQ
The vulnerability allows an attacker to bypass the check of 'isBluetoothShareUri' and gain access to the Bluetooth app's accessible ContentProviders. This can lead to local information disclosure.
Yes, user interaction is necessary for successful exploitation of this vulnerability.
The vulnerability was introduced in version 11.0 and affects all subsequent versions up to version 13.0.
Yes, a fix has been provided by the package maintainers. Developers should update to the fixed version released on or after March 1, 2023.
You can find more information about this vulnerability in the official Android Open Source Project Security Bulletin: [https://storage.googleapis.com/android-osv/ASB-A-225880741.json]
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/modules/Bluetooth.
