PT-2024-19877 · Unknown · Android Spoon

Yoshihito Sakai · Published 2024-01-23 · Updated 2024-01-29 · CVE-2024-23453

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android Spoon application versions 7.11.1 through 8.6.0

Description The issue concerns the use of hard-coded credentials in the application, which could allow a local attacker to retrieve a hard-coded API key by reverse-engineering the application binary. This API key could then be used for unauthorized access to the associated service.

Recommendations For Android Spoon application versions 7.11.1 through 8.6.0, consider removing or securely storing the hard-coded API key to prevent unauthorized access until a patch is available. As a temporary workaround, restrict access to the application's binary to minimize the risk of reverse-engineering.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-23453

Affected Products

Android Spoon

References · 6

• https://spoon-support.spooncast.net/jp/update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-23453 · Security Note
• https://osv.dev/vulnerability/CVE-2024-23453 · Vendor Advisory
• https://play.google.com/store/apps/details?id=co.spoonme&hl=en_US · Note
• https://jvn.jp/en/jp/JVN96154238 · Note
• https://t.me/cvenotify/68447 · Telegram Post