CVE-2023-47355

Executive Summary

CVE-2023-47355 identifies a critical security flaw in the Android application "Eyuep Can Yilmaz {ROOT} Quick Reboot" (package: com.eypcnnapps.quickreboot), version 1.0.8. The application exposes broadcast receivers for system-level actions—PowerOff, Reboot, and Recovery—without proper input validation. This allows any unprivileged Android application or malicious actor to send unauthorized broadcasts, triggering a device reboot or shutdown without user consent. The vulnerability is unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is specific to the Android ecosystem and the third-party application "Quick Reboot." It is not related to NPM, PyPI, Go, or Ruby packages. The risk is amplified if the application is distributed through unofficial app stores or sideloaded, as it can be exploited by any app installed on the same device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the technical details, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (AV:L) – The attacker must have an app installed on the same device.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): None (PR:N) – No permissions needed to send broadcasts.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – The vulnerability affects the same device.
• Confidentiality (C): None (C:N) – No data exposure.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): High (A:H) – Device reboot or shutdown causes denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Estimated Base Score: 6.2 (Medium)

Threat Level: Medium. While the impact is limited to denial of service, the ease of exploitation (no permissions required) makes it a viable vector for malware or prank apps.

Deep Dive & Mechanics

The vulnerability lies in the Android manifest and broadcast receiver implementation. The application registers broadcast receivers for actions like com.eypcnnapps.quickreboot.widget.PowerOff, Reboot, and Recovery. These receivers are exported (accessible to other apps) and lack input validation or permission checks.

Technical Flow:

1. An attacker installs a malicious app on the same Android device.
2. The malicious app sends an Intent with the action string (e.g., com.eypcnnapps.quickreboot.widget.PowerOff).
3. The Android system delivers the intent to the vulnerable broadcast receiver.
4. The receiver executes the corresponding system command (e.g., PowerManager.reboot() or PowerManager.shutdown()) without verifying the sender.
5. The device reboots or shuts down, causing a denial of service.

Root Cause: Missing permission enforcement (CWE-862) and lack of input validation (CWE-20). The application should have required a custom permission or validated the intent's origin.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would include:

Vulnerable (AndroidManifest.xml snippet):

<receiver android:name=".widget.PowerOff" android:exported="true">
    <intent-filter>
        <action android:name="com.eypcnnapps.quickreboot.widget.PowerOff" />
    </intent-filter>
</receiver>

Patched (Hypothetical):

<receiver android:name=".widget.PowerOff" android:exported="false">
    <intent-filter>
        <action android:name="com.eypcnnapps.quickreboot.widget.PowerOff" />
    </intent-filter>
</receiver>

Or add a custom permission:

<permission android:name="com.eypcnnapps.quickreboot.REBOOT_PERMISSION" android:protectionLevel="signature" />
<receiver android:name=".widget.PowerOff" android:permission="com.eypcnnapps.quickreboot.REBOOT_PERMISSION">
    ...
</receiver>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Android device with the vulnerable app installed (version 1.0.8).
• A secondary malicious app or ADB access.

Exploit Code (Java for Android):

// Malicious app sending broadcast to trigger reboot
Intent intent = new Intent("com.eypcnnapps.quickreboot.widget.PowerOff");
sendBroadcast(intent);

Using ADB (if USB debugging enabled):

adb shell am broadcast -a com.eypcnnapps.quickreboot.widget.PowerOff

Lab Setup:

1. Install the vulnerable app on an Android emulator (e.g., Android Studio AVD).
2. Create a simple Android app with a button that sends the broadcast.
3. Run the malicious app and observe the device reboot.

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected broadcasts to com.eypcnnapps.quickreboot.* actions.
• Use Android's dumpsys to check for exported receivers:

  adb shell dumpsys package com.eypcnnapps.quickreboot
  

• Look for apps requesting no permissions but sending system-level intents.

Prevention:

• Uninstall the vulnerable app immediately.
• Use Android's "Permission Controller" to restrict background broadcasts.
• Implement app-level firewall or use a security solution that monitors broadcast receivers.

Indicators of Compromise (IOCs)

• Package Name: com.eypcnnapps.quickreboot
• App Version: 1.0.8
• Broadcast Actions:
  • com.eypcnnapps.quickreboot.widget.PowerOff
  • com.eypcnnapps.quickreboot.widget.Reboot
  • com.eypcnnapps.quickreboot.widget.Recovery
• Behavior: Device spontaneously reboots or shuts down without user interaction.
• Logcat Evidence:

  D/QuickReboot(1234): Received broadcast: com.eypcnnapps.quickreboot.widget.PowerOff
  I/ActivityManager(567): Process com.eypcnnapps.quickreboot has started
  

Detection Engineering

YARA Rule

rule android_quick_reboot_cve_2023_47355 {
    meta:
        description = "Detects the vulnerable Quick Reboot app package"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-47355"
    strings:
        $pkg = "com.eypcnnapps.quickreboot"
        $action1 = "com.eypcnnapps.quickreboot.widget.PowerOff"
        $action2 = "com.eypcnnapps.quickreboot.widget.Reboot"
        $action3 = "com.eypcnnapps.quickreboot.widget.Recovery"
    condition:
        $pkg and ($action1 or $action2 or $action3)
}

Sigma Rule

title: Android Broadcast Receiver Abuse for Quick Reboot
id: 8a3f7c2e-1b4d-4e5f-9a0b-6c7d8e9f0a1b
status: experimental
description: Detects unauthorized broadcasts to the vulnerable Quick Reboot app
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: android
detection:
    selection:
        EventID: 1001  # Example Android event ID for broadcast
        IntentAction:
            - "com.eypcnnapps.quickreboot.widget.PowerOff"
            - "com.eypcnnapps.quickreboot.widget.Reboot"
            - "com.eypcnnapps.quickreboot.widget.Recovery"
    condition: selection
falsepositives:
    - Legitimate use by the app itself
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2023-47355 - Unauthorized Quick Reboot Broadcast"; content:"com.eypcnnapps.quickreboot.widget.PowerOff"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Uninstall the application com.eypcnnapps.quickreboot version 1.0.8 from all devices.
2. Educate users to avoid installing apps from untrusted sources.
3. Monitor for any apps that request no permissions but can trigger system actions.

Long-term Fix:

• The vendor must release a patched version that sets android:exported="false" or implements a custom permission with signature protection level.
• Until then, no fix is available.

Workaround:

• Use Android's "App Ops" or a third-party firewall to block the app's broadcast receivers.
• Rooted devices can use pm disable to disable the app's components:

  adb shell pm disable com.eypcnnapps.quickreboot/.widget.PowerOff
  

Valters IT
Securing Digital Frontiers