[Suggested description]
An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary
permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS.
------------------------------------------
[Additional Information]
The manifest of Q90 declares the use of permissions. However some of
the declared functions are not required for proper functioning of the
application. The following application permissions are not required:
android.permission.SYSTEM_ALERT_WINDOW: Allows an app to create windows
using the type WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY,
shown on top of all other apps.
android.permission.WRITE_EXTERNAL_STORAGE: Declaring these permissions
for debugging purposes is common practice, but they should not be
carried over to production releases of the app.
android.permission.READ_EXTERNAL_STORAGE.
android.permission.CHANGE_WIFI_STATE: Allows applications to change
Wi-Fi connectivity state. android.permission.CHANGE_CONFIGURATION:
Allows access to the list of accounts (including usernames) in the
Accounts Service. android.permission.READ_CONTACTS: Allows an
application to read the user's contacts data.
android.permission.MANAGE_ACCOUNTS: The application can request create
or access accounts stored locally in the AccountManager.
android.permission.GET_ACCOUNTS: Allows access to the list of accounts
(including usernames) in the Accounts Service.
android.permission.BLUETOOTH: Allows applications to connect to paired
bluetooth devices. android.permission.BLUETOOTH_ADMIN: Allows
applications to discover and pair bluetooth devices.
android.permission.GET_TASKS: Allows the app to retrieve information
about currently and recently running tasks. This may allow the app to
discover information about which applications are used on the device.
The backup element (android:allowBackup) is manually set to true.
The sheer amount of unnecessary permissions, with potential high
security impact, (e.g. reading all contact information, retrieving
usernames, passwords and other personal information stored on the
device, changing system settings, connecting to other devices) provides
the application with an unnecessarily large amount of sensitive
information and (potential) control over older (API 16-22) mobile
devices and raises numerous questions regarding the intentions behind
this application.
------------------------------------------
[Vulnerability Type]
Insecure Permissions
------------------------------------------
[Vendor of Product]
TK-star
------------------------------------------
[Affected Product Code Base]
TK-Star Q90 Junior GPS horloge - 3.1042.9.8656
------------------------------------------
[Affected Component]
Q90 SeTracker2
------------------------------------------
[Attack Type]
Local
------------------------------------------
[Impact Code execution]
true
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[CVE Impact Other]
Excessive permissions can enable malicious behaviour.
------------------------------------------
[Attack Vectors]
to exploit the vulnerability, the application code must be updated with malicious intent.
------------------------------------------
[Has vendor confirmed or acknowledged the vulnerability?]
true
------------------------------------------
[Discoverer]
Dennis van Warmerdam, Jasper Nota, Jim Blankendaal
------------------------------------------
[Reference]
https://www.tk-star.com
Use CVE-2019-20468.