CVE-2019-14220 Information disclosure in n/a

Medium 6.5 Published 24 Sep 2019 Updated 5 Aug 2024

A malicious Android app can read arbitrary system files via a privileged service call in BlueStacks, exposing sensitive data to attackers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-14220?

CVE-2019-14220 is a medium-severity vulnerability in n/a, published on 24 Sep 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An issue was discovered in BlueStacks 4.110 and below on macOS and on 4.120 and below on Windows. BlueStacks employs Android running in a virtual machine (VM) to enable Android apps to run on Windows or MacOS. Bug is in a local arbitrary file read through a system service call. The impacted method runs with System admin privilege and if given the file name as parameter returns you the content of file. A malicious app using the affected method can then read the content of any system file which it is not authorized to read

Weakness: CWE-269

Which versions are affected by CVE-2019-14220?

It affects 1 product.

Products include Bluestacks Bluestacks.

How do I fix CVE-2019-14220?

No fix has been published for CVE-2019-14220 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-14220 being exploited?

There is no known exploitation of CVE-2019-14220 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-vhg6-2q67-24px.