PT-2024-23925 · Unknown · Replify-Messenger

Affan · Published 2024-04-01 · Updated 2024-08-01 · CVE-2024-3128

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Replify-Messenger version 1.0

Description A vulnerability has been found in the processing of the file androidmanifest.xml of the component Backup File Handler. This issue leads to exposure of backup files to an unauthorized control sphere, allowing potential attacks on physical devices. The exploit has been disclosed to the public. The vendor has been contacted and has decided not to maintain the app anymore, planning to revoke its availability in the Google Play Store.

Recommendations As a temporary workaround, consider removing the app and seeking alternatives to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-530

Related Identifiers

CVE-2024-3128

Affected Products

Replify-Messenger

References · 8

• 🔥 https://github.com/ctflearner/Android_Findings/blob/main/Replify-Messenger/Backup.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-3128 · Security Note
• https://vuldb.com/?id.258869 · Note
• https://t.me/cvenotify/88325 · Telegram Post
• https://t.me/cvenotify/86436 · Telegram Post
• https://vuldb.com/?submit.307761 · Note
• https://vuldb.com/?ctiid.258869 · Note
• https://twitter.com/oktsec/status/1777426672758784491 · Twitter Post