PT-2015-3957 · Google · Google Play Services Sdk

Isciurus · Publicado 2015-02-23 · Atualizado 2015-02-23 · CVE-2014-7922

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Play services SDK versions prior to 2015

Description The issue allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scopes, including the SID and LSID scopes, by setting specific parameters in OAuth token requests. This can be achieved by a crafted application, potentially leading to unauthorized access to a Google account. The has permission=1 parameter value can be set upon finding opt has permission in the Bundle extras argument, demonstrating the vulnerability.

Recommendations For Google Play services SDK versions prior to 2015, consider restricting the use of the GoogleAuthUtil.getToken method until a patch is available, and avoid setting the opt has permission parameter in the Bundle extras argument to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-7922

Produtos afetados

Google Play Services Sdk

Referências · 3

• 🔥 https://gist.github.com/isciurus/df4d7edd9c3efb4a0753 · Exploit
• 🔥 http://isciurus.blogspot.com/2015/01/android-app-with-full-control-over-your.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7922 · Nota de Segurança