CENSUS has been investigating for some time now the exploitation potential of Man-in-the-Disk (MitD)  vulnerabilities in Android. Recently, CENSUS identified two such vulnerabilities in the popular WhatsApp messenger app for Android . The first of these was possibly independently reported to Facebook and was found to be patched in recent versions, while the second one was communicated by CENSUS to Facebook and was tracked as CVE-2021-24027 . As both vulnerabilities have now been patched, we would like to share our discoveries regarding the exploitation potential of such vulnerabilities with the rest of the community.
|Affected Products:||WhatsApp Messenger for Android, versions prior to 18.104.22.168|
|Class:||Exposure of Sensitive Information to an Unauthorized Control Sphere (CWE-497)|
|Discovered by:||Chariton Karamitas|
CENSUS identified that versions prior to 22.214.171.124 of WhatsApp for Android allowed third party apps to access
WhatsApp TLS 1.2 cryptographic material, as this was stored in "app-specific external storage". On Android 9 and previous versions of Android, the material is exposed to any third party app that bears the READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE permission. On Android 10 a malicious app would also require the requestLegacyExternalStorage attribute to access the files. Through the installation of a malicious app, or alternatively, through the exploitation of a vulnerable app (or Android component) that resides on a WhatsApp user's mobile device, remote actors were able to control the victim user's TLS session cryptographic secrets and could thus perform Man-in-The-Middle attacks to WhatsApp communications. Research has shown that exploitation of this vulnerability can lead to remote code execution on the victim device. CENSUS strongly recommends updating WhatsApp to version 126.96.36.199 or greater. This is a serious vulnerability which could be abused for surveillance purposes.