CVE-2024-11136

Executive Summary

CVE-2024-11136 is a path traversal vulnerability in the default TCL Camera application for Android. The application exposes a content provider that does not properly validate URI paths, allowing a malicious application installed on the same device to supply a crafted URI and delete arbitrary files from the user's external storage. This vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is significant as it enables unauthorized file deletion without user interaction. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a pre-installed Android application vulnerability in the TCL device ecosystem.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Local (AV:L) – requires a malicious app on the device.
• Attack Complexity (AC): Low (AC:L) – no special conditions.
• Privileges Required (PR): Low (PR:L) – the malicious app needs minimal permissions.
• User Interaction (UI): None (UI:N) – no user action required.
• Scope (S): Unchanged (S:U) – the vulnerable component is the provider.
• Confidentiality (C): None (C:N) – no data exposure.
• Integrity (I): High (I:H) – files can be deleted.
• Availability (A): High (A:H) – file deletion impacts availability.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Estimated Score: 7.1 (High)

Threat Level: High – due to the ability to delete arbitrary files from external storage without user interaction.

Deep Dive & Mechanics

The vulnerability resides in the TCL Camera application's content provider. Content providers in Android are used to share data between applications. The TCL Camera provider exposes a URI that accepts file paths. Due to insufficient input validation, a malicious application can craft a URI with path traversal sequences (e.g., ../) to access and delete files outside the intended directory.

Root Cause: The provider does not sanitize or canonicalize the URI path before performing file operations. This allows an attacker to traverse up the directory tree and delete arbitrary files on the user's external storage (e.g., /sdcard/).

Attack Flow:

1. User installs a malicious application on the TCL device.
2. The malicious app queries the TCL Camera content provider with a crafted URI containing path traversal sequences.
3. The provider processes the URI and deletes the targeted file without proper validation.
4. The attacker can delete critical user data, such as photos, documents, or configuration files.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described conceptually.

Vulnerable Code (Conceptual):

// Vulnerable provider method
public int delete(Uri uri, String selection, String[] selectionArgs) {
    String path = uri.getPath();
    // No validation or canonicalization
    File file = new File(getExternalStorageDirectory(), path);
    if (file.exists()) {
        file.delete();
        return 1;
    }
    return 0;
}

Patched Code (Conceptual):

// Patched provider method
public int delete(Uri uri, String selection, String[] selectionArgs) {
    String path = uri.getPath();
    // Canonicalize and validate path
    File baseDir = getExternalStorageDirectory();
    File file = new File(baseDir, path);
    try {
        String canonicalPath = file.getCanonicalPath();
        String baseCanonicalPath = baseDir.getCanonicalPath();
        // Ensure the file is within the base directory
        if (!canonicalPath.startsWith(baseCanonicalPath)) {
            throw new SecurityException("Path traversal detected");
        }
        if (file.exists()) {
            file.delete();
            return 1;
        }
    } catch (IOException e) {
        // Handle error
    }
    return 0;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A TCL device with the vulnerable Camera application.
• Ability to install a malicious application (e.g., via ADB or sideloading).

Exploitation Steps:

1. Create a malicious Android application that targets the TCL Camera content provider.
2. Craft a URI with path traversal to delete a specific file, e.g., content://com.tcl.camera.provider/delete/../../DCIM/Camera/photo.jpg.
3. Execute the delete operation from the malicious app.

Example Code (Conceptual):

// Malicious app code
ContentResolver resolver = getContentResolver();
Uri uri = Uri.parse("content://com.tcl.camera.provider/delete/../../DCIM/Camera/photo.jpg");
int deleted = resolver.delete(uri, null, null);

Blue Team

Detection:

• Monitor for unusual content provider queries from non-system apps.
• Log file deletion events on external storage.
• Use Android's PackageManager to detect apps requesting READ_EXTERNAL_STORAGE and WRITE_EXTERNAL_STORAGE permissions.

Mitigation:

• Apply input validation and path canonicalization in the provider.
• Restrict provider access to system apps only.
• Use Android's FileProvider with proper security configurations.

Indicators of Compromise (IOCs)

• File Paths: Unusual deletion of files in /sdcard/DCIM/, /sdcard/Documents/, or other external storage directories.
• Log Entries: Android logcat entries showing content provider delete operations with path traversal sequences.
• App Behavior: A non-system app querying the TCL Camera content provider with delete operations.

Detection Engineering

YARA Rule

rule TCL_Camera_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in TCL Camera content provider"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-11136"
    strings:
        $uri_pattern = /content:\/\/com\.tcl\.camera\.provider\/delete\/.*\.\.\//
    condition:
        $uri_pattern
}

Sigma Rule

title: TCL Camera Path Traversal Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in TCL Camera content provider
author: Valters IT
date: 2024/01/01
references:
    - CVE-2024-11136
logsource:
    category: process_creation
    product: android
detection:
    selection:
        CommandLine|contains: "content://com.tcl.camera.provider/delete/"
        CommandLine|contains: "../"
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert http any any -> any any (msg:"TCL Camera Path Traversal Attempt"; flow:to_server; content:"content://com.tcl.camera.provider/delete/"; content:"../"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable provider: If possible, disable the TCL Camera content provider via ADB or device settings.
2. Restrict app permissions: Use Android's permission system to block unknown apps from accessing the provider.
3. Monitor for exploitation: Check device logs for unusual content provider queries.

Long-term Fix:

• TCL must release a patch that implements proper input validation and path canonicalization in the content provider.
• Users should update the Camera application as soon as a patch is available.

Workaround:

• Uninstall or disable the TCL Camera application if not needed.
• Use a third-party camera app that does not expose vulnerable providers.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert