PT-2024-24932 · Newpipe · Newpipe

Litetex · Published 2024-04-24 · Updated 2024-04-24 · CVE-2024-32876

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions NewPipe versions 0.13.4 through 0.26.1

Description The issue arises from the import of backups in NewPipe, which uses Java's Object Serialization Stream Protocol. This can lead to Arbitrary Code Execution if a user imports a malicious backup file from an untrusted source. An attacker would need to persuade a user to import such a file, allowing the execution of malicious code, potentially crashing the app, stealing user data, or performing actions through Android APIs. The attack requires no additional privileges and can be independent of the user or device.

Recommendations To resolve the issue, update to NewPipe version 0.27.0, which restricts the classes that can be deserialized, deprecates backups serialized with Java's Object Serialization Stream Protocol, and uses JSON serialization for new backups. As a temporary workaround, consider avoiding the import of backups from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-32876

GHSA-WXRM-JHPF-VP6V

Affected Products

Newpipe

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32876.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-32876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32876 · Security Note
• https://github.com/TeamNewPipe/NewPipe/security/advisories/GHSA-wxrm-jhpf-vp6v · Note
• https://github.com/TeamNewPipe/NewPipe/commit/a69bbab73220f36e53c801cf7e9ea3627bb017eb · Note
• https://github.com/TeamNewPipe/NewPipe/releases/tag/v0.27.0 · Note
• https://twitter.com/linuxpatch/status/1783226237281788070 · Twitter Post
• https://t.me/cvenotify/77952 · Telegram Post
• https://docs.oracle.com/javase/6/docs/platform/serialization/spec/protocol.html · Note
• https://t.me/cvenotify/77963 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1783236594880716836 · Twitter Post