CVE-2023-29761: SO-CVEs/CVE detailed.md at main · LianKee/SO-CVEs

Escalation of Privileges exists in Sleep（CVE-2023-29761）

Vendor: Urbandroid(http://twilight.urbandroid.org/)

Affected product: Sleep(com.urbandroid.sleep)

Version: 20230303

Download link： https://play.google.com/store/apps/details?id=com.urbandroid.sleep

Description of the vulnerability for use in the CVE：An issue found in Sleep v.20230303 allows unauthorized apps to cause escalation of privilege attacks by manipulating the SharedPreference files.

Additional information: The Sleep application allows unauthorized applications to use the methods provided in its exposed components to modify data in the SharedPreference file, which is loaded at application startup and affects critical application functionality.

Specifically, an attacker is able to change relevant settings in the application by modifying certain key data in the SharedPreference file, such as language, some displays of the interface, and also modify the uri of the alarm bell, resulting in an escalation of privilege attack.

poc:

public void attack_sleep() { ContentResolver contentResolver = getApplicationContext().getContentResolver(); Uri parse = Uri.parse(“content://com.urbandroid.sleep.multiprocesspreferences.PREFFERENCE_AUTHORITY/a/a”); ContentValues contentValues = new ContentValues(); contentValues.put(targetKey, targetValue); contentResolver.insert(parse, contentValues); }