PT-2023-16286 · Google · Youtube Embedded 1.2 Sdk

Published 2023-03-01 · Updated 2023-03-09 · CVE-2023-0460

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions YouTube Embedded 1.2 SDK

Description The YouTube Embedded 1.2 SDK has a potential vulnerability in its binding logic. After binding to a service within the YouTube Main App, a remote context is created with the flags Context.CONTEXT INCLUDE CODE | Context.CONTEXT IGNORE SECURITY, allowing the client app to remotely load code from the YouTube Main App by retrieving its ClassLoader. This vulnerability can be triggered when the SDK calls bindService() on a malicious app instead of the YouTube Main App, enabling the malicious app to load arbitrary code into the calling app. An attacker must masquerade the YouTube app, install it on a device, and have a second app that uses the Embedded player, typically distributing both to the victim outside of the Play Store.

Recommendations As a temporary workaround, consider restricting the use of the YouTube Embedded 1.2 SDK until a patch is available. Avoid using the SDK in apps that are distributed outside of the Play Store to minimize the risk of exploitation. Restrict access to the bindService() function to prevent malicious apps from loading arbitrary code into the calling app. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2023-0460

Affected Products

Youtube Embedded 1.2 Sdk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-0460 · Security Note
• https://osv.dev/vulnerability/CVE-2023-0460 · Vendor Advisory
• https://t.me/cvenotify/45852 · Telegram Post
• https://developers.google.com/youtube/android/player/downloads · Note
• https://t.me/cibsecurity/59256 · Telegram Post
• https://t.me/cvenotify/45270 · Telegram Post