PT-2023-28451 · Samsung · Galaxy Store

Published 2023-12-04 · Updated 2024-08-29 · CVE-2023-42581

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Galaxy Store versions prior to 4.5.64.4

Description The issue is related to improper URL validation from InstantPlay deeplink in Galaxy Store, allowing attackers to execute JavaScript API and access data. This can lead to remote code execution.

Recommendations For Galaxy Store versions prior to 4.5.64.4, update to version 4.5.64.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the InstantPlay deeplink feature until a patch is applied. Avoid using the InstantPlay deeplink in the affected Galaxy Store versions until the issue is resolved.

Fix

Related Identifiers

CVE-2023-42581

ZDI-24-830

Affected Products

Galaxy Store

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2023-42581 · Security Note
• https://security.samsungmobile.com/serviceWeb.smsb?year=2023&month=12 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-830 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42581 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1731927574324916352 · Twitter Post
• https://t.me/cvenotify/63236 · Telegram Post
• https://t.me/cvenotify/92742 · Telegram Post
• https://t.me/cvenotify/92540 · Telegram Post
• https://t.me/cvenotify/92561 · Telegram Post
• https://twitter.com/CVEnew/status/1731869102350770539 · Twitter Post