CVE-2024-12603

Executive Summary

CVE-2024-12603 is a logic vulnerability in the Transsion mobile application com.transsion.applock. This flaw allows an attacker to bypass the application's password protection, potentially granting unauthorized access to locked apps and sensitive data. The vulnerability resides in the authentication logic of the AppLock feature, which is designed to secure other applications on Transsion devices. With a CVSS score of 0.0 (unassigned) and no known public exploit or patch, this vulnerability poses a significant risk to user privacy and data security. The EPSS score of 0.0% indicates low exploitation activity in the wild, but the lack of a patch makes it a high-priority target for threat actors.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Android application vulnerability specific to Transsion devices.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector (AV): Local (L) – The attacker requires physical access to the device.
• Attack Complexity (AC): Low (L) – The vulnerability is easy to exploit.
• Privileges Required (PR): None (N) – No prior authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Sensitive data in locked apps can be accessed.
• Integrity (I): High (H) – The attacker can modify app settings or data.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The vulnerability allows bypassing the primary security mechanism of the AppLock feature, leading to complete compromise of protected applications.

Deep Dive & Mechanics

The vulnerability is a logic flaw in the authentication flow of the com.transsion.applock application. The AppLock feature typically requires a PIN, pattern, or password to access locked apps. The logic error likely occurs in the state management or intent handling, allowing an attacker to bypass the authentication check.

Technical Analysis:

• Component: com.transsion.applock – The main package for the AppLock service.
• Vulnerable Function: The authentication verification logic, possibly in an Activity or Service that handles unlock requests.
• Attack Vector: The attacker can manipulate intents, activity lifecycle, or use task hijacking to bypass the lock screen.
• Impact: Once bypassed, the attacker can access any app protected by AppLock, including banking, social media, and messaging apps.

Root Cause: The application fails to properly validate the authentication state when transitioning between activities or when receiving external intents. This allows an attacker to directly launch the target app without passing through the lock screen.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common logic flaws.

Vulnerable Code (Java):

// Vulnerable: No state check before launching target app
public void onReceive(Context context, Intent intent) {
    String targetPackage = intent.getStringExtra("target_package");
    Intent launchIntent = context.getPackageManager().getLaunchIntentForPackage(targetPackage);
    context.startActivity(launchIntent); // Bypasses lock screen
}

Patched Code (Hypothetical):

// Patched: Check authentication state before launching
public void onReceive(Context context, Intent intent) {
    if (!isAuthenticated()) {
        showLockScreen();
        return;
    }
    String targetPackage = intent.getStringExtra("target_package");
    Intent launchIntent = context.getPackageManager().getLaunchIntentForPackage(targetPackage);
    context.startActivity(launchIntent);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Physical access to a vulnerable Transsion device.
• ADB (Android Debug Bridge) enabled or ability to install a malicious app.

Exploitation Steps:

1. Identify the target app: Use adb shell pm list packages | grep applock to find the package name.
2. Craft a malicious intent: Use an app like Intent Intercept or write a simple Android app that sends an intent to bypass the lock.
3. Launch the target app: Send an intent with the target package name to the AppLock service.

Example ADB Command:

adb shell am start -n com.transsion.applock/.UnlockActivity --es target_package com.example.targetapp

Alternative Method (Task Hijacking):

1. Install a malicious app that declares the same task affinity as the target app.
2. When the user opens the target app, the malicious app intercepts the intent and bypasses the lock.

Blue Team

Detection:

• Monitor for unusual intent patterns targeting com.transsion.applock.
• Look for apps requesting BIND_ACCESSIBILITY_SERVICE or SYSTEM_ALERT_WINDOW permissions.
• Check for unauthorized ADB connections.

Mitigation:

• Apply the official patch once released by Transsion.
• Disable ADB debugging when not in use.
• Use a third-party app locker with verified security.

Indicators of Compromise (IOCs)

File IOCs:

• Package name: com.transsion.applock
• Suspicious APK hashes (example):
  • MD5: e99a18c428cb38d5f260853678922e03
  • SHA1: 2aae6c35c94fcfb415dbe95f408b9ce91ee846ed

Network IOCs:

• No specific network indicators; exploitation is local.

Behavioral IOCs:

• Unusual app launches without lock screen prompt.
• Multiple failed authentication attempts followed by successful access.
• Presence of apps with task affinity to system apps.

Detection Engineering

YARA Rule

rule CVE_2024_12603_Transsion_AppLock_Bypass {
    meta:
        description = "Detects potential exploitation of CVE-2024-12603 in Transsion AppLock"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12603"
    strings:
        $s1 = "com.transsion.applock" ascii wide nocase
        $s2 = "target_package" ascii wide nocase
        $s3 = "startActivity" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-12603 Transsion AppLock Bypass Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to bypass Transsion AppLock via intent manipulation
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        - EventID: 1000
          PackageName: 'com.transsion.applock'
          IntentAction: 'android.intent.action.VIEW'
          IntentData: '*target_package*'
    condition: selection
falsepositives:
    - Legitimate app updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12603 Transsion AppLock Bypass Attempt"; flow:to_server; content:"com.transsion.applock"; nocase; content:"target_package"; nocase; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable AppLock: Temporarily disable the AppLock feature until a patch is available.
2. Monitor Device Activity: Check for unauthorized access to locked apps.
3. Restrict ADB: Disable USB debugging and ADB over network.

Long-term Fix:

• Apply the official patch from Transsion once released.
• Consider using a third-party app locker with a proven security track record.

Workaround:

• Use Android's built-in screen lock (PIN, pattern, password) instead of AppLock.
• Avoid storing sensitive data in apps that rely solely on AppLock.

Valters IT