PT-2024-21291 · Unknown · Element Android

Smaury + 2 · Published 2024-02-20 · Updated 2024-05-05 · CVE-2024-26132

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Element Android versions 0.91.0 through 1.6.12

Description A third-party malicious application installed on the same phone can force Element Android to share files stored under the files directory in the application's private data directory to an arbitrary room. The impact of the attack is reduced by the fact that the databases stored in this folder are encrypted. However, it contains some other potentially sensitive information, such as the FCM token.

Recommendations For Element Android versions 0.91.0 through 1.6.11, update to version 1.6.12 to resolve the issue. For forks of Element Android which have set android:exported="false" in the AndroidManifest.xml file for the IncomingShareActivity activity, no action is required as they are not impacted.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-26132

GHSA-8WJ9-CX7H-PVM4

Affected Products

Element Android

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26132.json · Exploit
• https://github.com/element-hq/element-android/security/advisories/GHSA-8wj9-cx7h-pvm4 · Vendor Advisory
• https://github.com/element-hq/element-android/commit/8f9695a9a8d944cb9b92568cbd76578c51d32e07 · Patch
• https://osv.dev/vulnerability/CVE-2024-26132 · Vendor Advisory
• https://element.io/blog/security-release-element-android-1-6-12 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-26132 · Security Note
• https://twitter.com/cr0n0sh4/status/1781151717406445849 · Twitter Post
• https://t.me/cybersecuritytechnologies/10433 · Telegram Post
• https://t.me/rnetsec/20272 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1763097412187443211 · Twitter Post
• https://twitter.com/payloadartist/status/1781024892260888843 · Twitter Post
• https://t.me/defcon_news/123030 · Telegram Post
• https://twitter.com/Bug_X_hunter/status/1786252454029631833 · Twitter Post
• https://twitter.com/Dinosn/status/1787114822959595671 · Twitter Post
• https://twitter.com/CVEnew/status/1760010973027479949 · Twitter Post