CVE-2023-40136: ADP Grant - Enumerating other users' contact photos via dialog header presentation shown in AutoFillService's DialogFillUi
Summary
CVE-2023-40136: In setHeader of DialogFillUi.java, there is a possible way to view other user's images due to a confused deputy. Affects platform/frameworks/base across 4 version ranges.
>= 12:0, < 12:2025-02-01
>= 12L:0, < 12L:2025-02-01
>= 13:0, < 13:2025-02-01
>= 15-next:0, < 15-next:2025-02-01
Fixed in 15-next:2025-02-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package is responsible for providing the fundamental framework for the Android operating system. It includes various components and services that enable the functioning of Android devices. One of the components is AutoFillService, which is responsible for automatically filling in user data in forms and dialogs. AutoFillService's DialogFillUi is a class that handles the presentation of dialogs for autofill purposes.
Vulnerability Detail
The vulnerability in question exists in the setHeader method of DialogFillUi.java. Due to a confused deputy issue, it is possible to view another user's contact photos through the dialog header presentation. This vulnerability can be exploited to disclose local information without requiring additional execution privileges. It is important to note that user interaction is not necessary for the exploitation of this vulnerability.
How To Fix
Minimum fixed version
15-next:2025-02-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the platform/frameworks/base package allows for the enumeration of other users' contact photos through the dialog header presentation in AutoFillService's DialogFillUi. This can lead to local information disclosure without requiring additional execution privileges. It is crucial to apply the provided fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is local information disclosure. An attacker can view another user's contact photos through the dialog header presentation, potentially compromising user privacy.
No, user interaction is not needed for the exploitation of this vulnerability.
No, no additional execution privileges are needed to exploit this vulnerability.
Versions 11, 12, 12L, and 13 of the Android ecosystem are affected by this vulnerability.
Yes, a fix has been provided by the Android Open Source Project (AOSP). It is recommended to update the affected package to a version that includes the fix.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
