CVE-2023-40121: SQL Injection in ContactsProvider#query via URI PathSegments
Summary
CVE-2023-40121: In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. Affects platform/frameworks/base across 5 version ranges.
>= 11:0, < 11:2023-10-01
>= 12:0, < 12:2023-10-01
>= 12L:0, < 12L:2023-10-01
>= 13:0, < 13:2023-10-01
>= 14-next:0, < 14-next:2023-10-01
Fixed in 14-next:2023-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package provides the fundamental components and infrastructure for the Android operating system. It includes various libraries, services, and APIs that enable the functioning of Android devices. The ContactsProvider component is responsible for managing contacts and related data on the device.
Vulnerability Detail
The vulnerability in ContactsProvider#query is a SQL injection vulnerability that arises due to unsafe deserialization in the appendEscapedSQLString method of DatabaseUtils.java. This vulnerability allows an attacker to inject malicious SQL queries via URI PathSegments, potentially leading to local information disclosure. Exploitation of this vulnerability requires user execution privileges, but does not require user interaction.
How To Fix
Minimum fixed version
14-next:2023-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The SQL injection vulnerability in ContactsProvider#query via URI PathSegments can be mitigated by updating the platform/frameworks/base package to the fixed versions. This will ensure the safety of user data and prevent potential information disclosure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The vulnerability allows an attacker to execute malicious SQL queries, potentially leading to local information disclosure.
Exploitation of this vulnerability requires user execution privileges.
No, user interaction is not needed for exploitation.
Versions 11, 12, 12L, and 13 of the Android ecosystem are affected.
Yes, the fix for this vulnerability is available in the fixed versions of the platform/frameworks/base package.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
