CVE-2023-21141: Open Source Vulnerability in platform/packages/apps/Traceur
Summary
CVE-2023-21141: In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. Affects platform/packages/apps/Traceur across 5 version ranges.
>= 11:0, < 11:2023-06-01
>= 12:0, < 12:2023-06-01
>= 12L:0, < 12L:2023-06-01
>= 13:0, < 13:2023-06-01
>= 13-next:0, < 13-next:2023-06-01
Fixed in 13-next:2023-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/packages/apps/Traceur is an Android package that provides developer mode traces for debugging purposes. It allows developers to record and analyze trace logs to identify performance issues and optimize their applications. However, a vulnerability has been discovered in several functions of this package that allows a guest user to access the trace logs recorded by an admin user. This vulnerability bypasses permissions and can lead to local information disclosure without requiring any additional execution privileges. Exploitation of this vulnerability does not require user interaction.
Vulnerability Detail
The vulnerability in platform/packages/apps/Traceur arises from a permissions bypass in several functions of the package. This allows a guest user to access developer mode traces, which may contain sensitive information recorded by an admin user. The impact of this vulnerability is local information disclosure, where an unauthorized user can view trace logs that they should not have access to. This can potentially expose sensitive data and compromise the security of the application. The vulnerability affects multiple versions of the Android ecosystem, including versions 11, 12, 12L, and 13.
How To Fix
Minimum fixed version
13-next:2023-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to restrict access to developer mode traces and ensure that only authorized users have permissions to view and analyze these logs. Additionally, regular monitoring and auditing of access to trace logs can help detect any unauthorized access attempts.
Conclusion
The vulnerability in platform/packages/apps/Traceur allows a guest user to access trace logs recorded by an admin user, leading to local information disclosure. To mitigate this risk, it is crucial to update the package to the fixed versions released on June 1, 2023. Regular monitoring and auditing of access to trace logs can also help detect any unauthorized access attempts. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for platform/packages/apps/Traceur →
FAQ
The impact of this vulnerability is local information disclosure, where an unauthorized user can view trace logs recorded by an admin user. This can potentially expose sensitive data and compromise the security of the application.
No, exploitation of this vulnerability does not require user interaction.
This vulnerability affects versions 11, 12, 12L, and 13 of the Android ecosystem.
There is no specific workaround mentioned for this vulnerability. However, restricting access to developer mode traces and monitoring access can help mitigate the risk.
To fix this vulnerability, update the platform/packages/apps/Traceur package to the latest fixed version released on June 1, 2023.
Related vulnerabilities
Recent vulnerabilities recorded for platform/packages/apps/Traceur.
