PT-2024-40049 · Unknown · Shared Preferences Android

Published 2024-12-06 · Updated 2024-12-06

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions shared preferences android versions prior to 2.3.4

Description The issue arises from the serialization and deserialization of special string prefixes used to store data types that are not natively representable by the available storage options. This process allows for the deserialization of arbitrary classes, leading to arbitrary code execution. An attacker can overwrite files containing preferences with a malicious version that includes a deserialization payload, which is triggered when the data is loaded from the disk.

Recommendations For versions prior to 2.3.4, update to the latest version of shared preferences android that contains the changes to address this issue. As a temporary workaround, consider restricting access to the deserialization process until a patch is applied.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

GHSA-3HPF-FF72-J67P

Affected Products

Shared Preferences Android

References · 4

• https://osv.dev/vulnerability/GHSA-3hpf-ff72-j67p · Vendor Advisory
• https://github.com/flutter/packages/commit/15501ece235684a3bdddad089345fc3e33dc1df3 · Note
• https://github.com/flutter/packages · Note
• https://github.com/flutter/packages/security/advisories/GHSA-3hpf-ff72-j67p · Note