PT-2015-3957 · Google · Google Play Services Sdk

Isciurus · Published 2015-02-23 · Updated 2015-02-23 · CVE-2014-7922

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Play services SDK versions prior to 2015

Description The issue allows attackers to bypass an intended consent dialog and retrieve tokens for arbitrary OAuth scopes, including the SID and LSID scopes, by setting specific parameters in OAuth token requests. This can be achieved by a crafted application, potentially leading to unauthorized access to a Google account. The has permission=1 parameter value can be set upon finding opt has permission in the Bundle extras argument, demonstrating the vulnerability.

Recommendations For Google Play services SDK versions prior to 2015, consider restricting the use of the GoogleAuthUtil.getToken method until a patch is available, and avoid setting the opt has permission parameter in the Bundle extras argument to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-7922

Affected Products

Google Play Services Sdk

References · 3

• 🔥 https://gist.github.com/isciurus/df4d7edd9c3efb4a0753 · Exploit
• 🔥 http://isciurus.blogspot.com/2015/01/android-app-with-full-control-over-your.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-7922 · Security Note