PT-2022-10197 · Tencent · Qq

Published 2022-07-26 · Updated 2022-08-04 · CVE-2021-33057

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions QQ application version 8.7.1

Description The issue concerns the QQ application's failure to enforce permission requirements for determining a device's physical location, such as android.permission.ACCESS FINE LOCATION. An attacker can exploit this by creating a MapContext object using qq.createMapContext, moving the map center to the device's location with MapContext.moveToLocation, and then obtaining the latitude and longitude of the current map center using MapContext.getCenterLocation.

Recommendations For version 8.7.1, consider disabling the use of qq.createMapContext and related functions until a patch is available to enforce proper permission requirements. Restrict access to location services to minimize the risk of exploitation. Avoid using MapContext.moveToLocation and MapContext.getCenterLocation in sensitive contexts until the issue is resolved.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2021-33057

Affected Products

Qq

References · 6

• 🔥 https://github.com/BESTICSP/Vulnerabilities-Related-to-Mini-Programs-Permissions/blob/main/QQ%20applet%20location%20permission%20vulnerability%20report.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-33057 · Security Note
• https://tencent.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33057 · Vendor Advisory
• https://arxiv.org/pdf/2205.15202.pdf · Note
• https://t.me/cvenotify/34254 · Telegram Post