PT-2023-28361 · Unknown · Wave.Ai.Browser

Edward Warren · Published 2023-09-11 · Updated 2023-09-13 · CVE-2023-42471

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions wave.ai.browser application through 1.0.35 for Android

Description The issue allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It contains a manifest entry that exports the wave.ai.browser.ui.splash.SplashScreen activity. This activity uses a WebView component to display web content and doesn't adequately validate or sanitize the URI or any extra data passed in the intent by a third party application (with no permissions).

Recommendations For wave.ai.browser application through 1.0.35 for Android, consider disabling the wave.ai.browser.ui.splash.SplashScreen activity until a patch is available to prevent exploitation. Restrict access to the WebView component to minimize the risk of arbitrary JavaScript code execution. Avoid using intents from untrusted sources to prevent passing malicious data to the application.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-42471

Affected Products

Wave.Ai.Browser

References · 8

• 🔥 https://github.com/actuator/cve/blob/main/CVE-2023-42471 · Exploit
• 🔥 https://github.com/actuator/wave.ai.browser/blob/main/poc.apk · Exploit
• 🔥 https://github.com/actuator/wave.ai.browser/blob/main/CWE-94.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-42471 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42471 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1701184207718961654 · Twitter Post
• https://twitter.com/CVEnew/status/1701132182985605236 · Twitter Post
• https://t.me/cibsecurity/70203 · Telegram Post