Samsung patches vulnerabilities that exposed Galaxy Store to attackers

Samsung Electronics Co. Ltd. has patched vulnerabilities in its Galaxy Retailer app that might have allowed dangerous actors to put in any app on a focused cellular machine with out the machine proprietor’s data or consent.

Detailed Jan. 20 by researchers at NCC Group plc, the primary vulnerability, designated CVE-2023-21433, opens the door for attackers to put in purposes by way of an export operate that doesn’t safely deal with incoming intents.

An attacker may exploit an present utility put in on a tool to routinely set up any utility out there within the Galaxy Retailer app with out the person’s data. The vulnerability doesn’t apply to Android 13 due to modifications made within the working system, with solely Android 12 and under affected.

The second vulnerability, designated CVE-2023-21434, is an improper enter validation situation that might enable an attacker to execute JavaScript by launching a webpage. The problem is the results of an incorrectly configured filter in webview within the Galaxy Retailer app, permitting webview to browse to an attacker-controlled area. By tapping a malicious hyperlink in Google Chrome or a pre-installed rogue utility, an attacker can bypass Samsung’s URL filter to ship malicious content material to a person.

For each vulnerabilities, customers are inspired to put in the newest replace to the Galaxy Retailer app.

“As a normal rule, outdoors of cellular machine administration sort apps, apps shouldn’t be capable of set up different apps on cellular,” JT Keating, senior vice chairman of Strategic Initiatives at cellular safety options supplier Zimperium Inc., informed SiliconANGLE. “It’s a part of the safety developments that cellular OS’s have over conventional OS’s.”

Mike Parkin, senior technical engineer at enterprise cyber danger remediation firm Vulcan Cyber Ltd., stated that though these are technically native exploits, the JavaScript model poses extra of a priority.

“Although an attacker must get a sufferer to execute the hostile JavaScript and get their malicious utility onto the Galaxy App Retailer to be downloaded, thankfully Samsung has already patched the problems,” Parkin defined. “Additionally, the primary situation doesn’t seem like efficient towards Android 13, which has been out there since August 2022.”

Picture: Samsung