CVE-2023-40137: ADP Grant - Enumerating other users' contact photos via Dataset dialog presentation shown in AutoFillService's DialogFillUi
Summary
CVE-2023-40137: In createDatasetItems of DialogFillUi.java, there is a possible way to view another user's image. Affects platform/frameworks/base across 4 version ranges.
>= 12:0, < 12:2025-02-01
>= 12L:0, < 12L:2025-02-01
>= 13:0, < 13:2025-02-01
>= 15-next:0, < 15-next:2025-02-01
Fixed in 15-next:2025-02-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is platform/frameworks/base in the Android ecosystem. This package is responsible for providing the fundamental framework for Android applications. It includes various components and services that enable the functioning of the Android operating system. One of the components, AutoFillService's DialogFillUi, is responsible for presenting a dataset dialog to users for autofill suggestions. This dialog allows users to select contact photos for autofill purposes.
Vulnerability Detail
The vulnerability exists in multiple functions of DialogFillUi.java. It arises due to a confused deputy scenario, where the application does not properly validate the user's permissions before displaying contact photos. As a result, an attacker can exploit this vulnerability to view contact photos of other users without requiring any additional execution privileges. This can lead to local information disclosure. Notably, user interaction is not necessary for the exploitation of this vulnerability.
How To Fix
Minimum fixed version
15-next:2025-02-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in the platform/frameworks/base package of the Android ecosystem allows for the enumeration of other users' contact photos. This can lead to local information disclosure without requiring additional execution privileges. It is recommended to apply the provided fix from the Android Open Source Project to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
The impact of this vulnerability is local information disclosure, where an attacker can view contact photos of other users without requiring additional execution privileges.
No, user interaction is not needed for the exploitation of this vulnerability.
Versions 11, 12, 12L, and 13 of the Android ecosystem are affected.
Yes, a fix has been provided by the Android Open Source Project (AOSP) and can be applied by updating the affected package to a version where the fix has been implemented.
You can find more information about this vulnerability in the Open Source Vulnerability database at: https://storage.googleapis.com/android-osv/ASB-A-281665050.json
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
