PT-2024-12097 · Xiaomi · Xiaomigetapps

Published 2024-08-21 · Updated 2024-09-12 · CVE-2023-26324

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XiaomiGetApps (affected versions not specified)

Description A code execution vulnerability exists in the XiaomiGetApps application product, caused by the verification logic being bypassed. An attacker can exploit this vulnerability to execute malicious code. The exploitation involves opening a URL in WebView, injecting JavaScript, executing JavaScript Interface functions from vulnerable GetApps to install and launch payload, and getting shell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-26324

Affected Products

Xiaomigetapps

References · 12

• https://osv.dev/vulnerability/CVE-2023-26324 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26324 · Security Note
• https://twitter.com/VulmonFeeds/status/1828744082421584322 · Twitter Post
• https://twitter.com/CveFindCom/status/1828704630781435992 · Twitter Post
• https://https//trust.mi.com/misrc/bulletins/advisory?cveId=544 · Note
• https://t.me/cvenotify/92493 · Telegram Post
• https://twitter.com/androidmalware2/status/1826191136198680719 · Twitter Post
• https://t.me/cvedetector/4317 · Telegram Post
• https://t.me/thebugbountyhunter/9048 · Telegram Post
• https://twitter.com/cracbot/status/1830123563577458921 · Twitter Post
• https://t.me/poxek/4313 · Telegram Post
• https://twitter.com/CVEnew/status/1828698575489978450 · Twitter Post