CVE-2018-14991 Missing authorization in n/a
A pre-installed RCS app on specific Android devices exposes an unprotected content provider, allowing any local app to read and modify user text messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-14991?
CVE-2018-14991 is a critical missing authorization vulnerability in n/a, published on 25 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Coolpad Defiant device with a build fingerprint of Coolpad/cp3632a/cp3632a:7.1.1/NMF26F/099480857:user/release-keys, the ZTE ZMAX Pro with a build fingerprint of ZTE/P895T20/urd:6.0.1/MMB29M/20170418.114928:user/release-keys, and the T-Mobile Revvl Plus with a build fingerprint of Coolpad/alchemy/alchemy:7.1.1/143.14.171129.3701A-TMO/buildf_nj_02-206:user/release-keys all contain a vulnerable, pre-installed Rich Communication Services (RCS) app. These devices contain an that app has a package name of com.suntek.mway.rcs.app.service (versionCode=1, versionName=RCS_sdk_M_native_20161008_01; versionCode=1, versionName=RCS_sdk_M_native_20170406_01) with an exported content provider named com.suntek.mway.rcs.app.service.provider.message.MessageProvider and a refactored version of the app with a package name of com.rcs.gsma.na.sdk (versionCode=1, versionName=RCS_SDK_20170804_01) with a content provider named com.rcs.gsma.na.provider.message.MessageProvider allow any app co-located on the device to read, write, insert, and modify the user's text messages. This is enabled by an exported content provider app component that serves as a wrapper to the official content provider that contains the user's text messages. This app cannot be disabled by the user and the attack can be performed by a zero-permission app.
Weakness: CWE-20
Which versions are affected by CVE-2018-14991?
It affects 3 products.
Products include Coolpad Defiant Firmware, T-Mobile Revvl Plus Firmware, T-Mobile Zte Zmax Pro Firmware.
How do I fix CVE-2018-14991?
No fix has been published for CVE-2018-14991 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-14991 being exploited?
There is no known exploitation of CVE-2018-14991 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wgwv-h6gg-qxww.