PT-2024-24328 · Unknown · Com.Solarized.Firedown

Edward Warren · Published 2024-05-17 · Updated 2024-07-10 · CVE-2024-31974

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions com.solarized.firedown (aka Solarized FireDown Browser & Downloader) version 1.0.76

Description The issue allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. This is possible because com.solarized.firedown.IntentActivity uses a WebView component to display web content and does not adequately sanitize the URI or any extra data passed in the intent by any installed application, regardless of permissions. The problem impacts the WebView component, allowing permission escalation.

Recommendations For version 1.0.76, update the application to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting the use of the WebView component in the com.solarized.firedown.IntentActivity until a patch is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-31974

Affected Products

Com.Solarized.Firedown

References · 3

• 🔥 https://github.com/actuator/com.solarized.firedown/blob/main/CVE-2024-31974 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31974 · Security Note
• https://twitter.com/oktsec/status/1811040085023883531 · Twitter Post