CVE-2023-40139: ADP Grant - Enumerating other users' contact photos via header or footer presentation shown in AutoFillService's FillUi
Summary
CVE-2023-40139: In FillUi of FillUi.java, there is a possible way to view other user's image due to a confused deputy. Affects platform/frameworks/base across 4 version ranges.
>= 12:0, < 12:2025-02-01
>= 12L:0, < 12L:2025-02-01
>= 13:0, < 13:2025-02-01
>= 15-next:0, < 15-next:2025-02-01
Fixed in 15-next:2025-02-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is platform/frameworks/base, which is part of the Android ecosystem. This package provides the fundamental building blocks for Android applications and includes various components such as activity and service management, resource handling, and user interface rendering. The vulnerability affects versions 11, 12, 12L, and 13 of the package. It is important to note that exploitation of this vulnerability does not require user interaction.
Vulnerability Detail
The vulnerability exists in the FillUi component of FillUi.java. It stems from a confused deputy issue, allowing an attacker to view contact photos of other users. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive information without requiring additional execution privileges. This vulnerability poses a risk of local information disclosure.
How To Fix
Minimum fixed version
15-next:2025-02-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the platform/frameworks/base package in the Android ecosystem is vulnerable to an information disclosure issue that allows unauthorized access to contact photos of other users. It is crucial to update the package to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for platform/frameworks/base →
FAQ
This vulnerability allows an attacker to view contact photos of other users, leading to local information disclosure.
No, exploitation of this vulnerability does not require user interaction.
Versions 11, 12, 12L, and 13 of the platform/frameworks/base package are affected.
The recommended mitigation is to update the package to the fixed versions mentioned in the 'how_to_fix' section.
Yes, more information about this vulnerability can be found in the Open Source Vulnerabilities database: [source_link].
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
