PT-2020-16016 · Innogames · God Kings

Published 2020-10-27 · Updated 2020-11-04 · CVE-2020-25204

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions God Kings application version 0.60.1

Description The issue concerns the exposure of a broadcast receiver in the God Kings application, specifically com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver, which is intended to display in-game push notifications. However, the application lacks an authorization schema for this broadcast receiver, allowing any application to send fully customizable in-game push notifications. This could potentially be exploited for spoofing in-game notifications.

Recommendations For God Kings application version 0.60.1, consider restricting access to the com.innogames.core.frontend.notifications.receivers.LocalNotificationBroadcastReceiver broadcast receiver to prevent unauthorized applications from sending in-game push notifications. As a temporary workaround, disabling the broadcast receiver until a proper authorization schema is implemented could mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2020-25204

Affected Products

God Kings

References · 4

• 🔥 http://packetstormsecurity.com/files/159747/God-Kings-0.60.1-Notification-Spoofing.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25204 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25204 · Vendor Advisory
• https://t.me/defcon_news/60215 · Telegram Post