App can start activity from background without permission
Summary
CVE-2023-40079: In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. Affects platform/frameworks/base across 2 version ranges.
>= 14:0, < 14:2023-12-01
>= 14-next:0, < 14-next:2023-12-01
Fixed in 14-next:2023-12-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package is a fundamental part of the Android operating system and provides core functionalities and services. It includes components such as activities, services, and content providers that are essential for the functioning of Android applications. However, a vulnerability has been identified in this package that allows an app to start an activity from the background without requiring any permission.
Vulnerability Detail
The vulnerability, identified as ASB-A-278722815, resides in the injectSendIntentSender method of ShortcutService.java. It allows for a permissions bypass, enabling the launch of a background activity. This vulnerability can be exploited to escalate privileges locally without needing additional execution privileges. Notably, user interaction is not required for exploitation. The impact of this vulnerability can be significant, as it can potentially lead to unauthorized access to sensitive information or the execution of malicious actions.
How To Fix
Minimum fixed version
14-next:2023-12-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the platform/frameworks/base package in the Android ecosystem is vulnerable to a permissions bypass that allows an app to start an activity from the background without requiring any permission. This vulnerability can be exploited to escalate privileges locally, potentially leading to unauthorized access or malicious actions. It is recommended to apply the provided fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an app to start an activity from the background without requiring any permission. It can potentially lead to unauthorized access to sensitive information or the execution of malicious actions.
No, user interaction is not needed for exploitation of this vulnerability.
The platform/frameworks/base package in the Android ecosystem is affected by this vulnerability.
This vulnerability is classified as High severity.
More information about this vulnerability can be found in the Open Source Vulnerability database at the following URL: https://storage.googleapis.com/android-osv/ASB-A-278722815.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
