Tom Barrasso

**Name of the Vulnerable Software and Affected Versions** KaiOS versions 3.0 through 3.1 **Description** An issue was discovered in the binary /system/kaios/api-daemon, which exposes a local web server on *.localhost with subdomains for each installed application. For example, myapp.localhost. An attacker can make fetch requests to api-daemon to determine if a given app is installed and read the manifest.webmanifest contents, including the app version. **Recommendations** For KaiOS versions 3.0 and 3.1, consider restricting access to the api-daemon binary to minimize the risk of exploitation. As a temporary workaround, consider disabling the local web server exposed by the api-daemon binary until a patch is available. Avoid using the api-daemon to fetch sensitive information, such as the manifest.webmanifest contents, until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** KaiOS versions 3.0 through 3.0 **Description** An issue was discovered in the /system/bin/tctweb server binary, which exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns proper CORS headers, it's accessible to all websites via the browser. At a bare minimum, this allows an attacker to retrieve a list of the user's installed apps, notifications, and downloads. It also allows an attacker to delete local files and modify system properties including the boolean `persist.moz.killswitch` property, which would render the device inoperable. This issue is partially mitigated by SELinux, which prevents reads, writes, or modifications to files or permissions within protected partitions. **Recommendations** For KaiOS version 3.0, update to version 3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the `/system/bin/tctweb server` binary to minimize the risk of exploitation. Additionally, be cautious when accessing websites via the browser to avoid potential attacks.

**Name of the Vulnerable Software and Affected Versions** KaiOS version 3.0 **Description** An issue was discovered in the pre-installed Communications application, which exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent, allowing the attacker to send the user's call logs to a remote server via `XMLHttpRequest` or `Fetch`. **Recommendations** For KaiOS version 3.0, consider disabling the Web Activity in the Communications application until a patch is available to prevent unauthorized access to the user's call log. Restrict access to sensitive information to minimize the risk of exploitation.