CVE-2024-45240 Code injection in n/a
Attackers can hijack JavaScript interfaces in the TikTok Android app via deeplinks, enabling code execution and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45240?
CVE-2024-45240 is a high-severity code injection vulnerability in n/a, published on 24 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.)
Which versions are affected by CVE-2024-45240?
How do I fix CVE-2024-45240?
No fix has been published for CVE-2024-45240 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-45240 being exploited?
There is no known exploitation of CVE-2024-45240 in the wild and no public exploit code.
Sources
Also known as GHSA-mp57-r77r-477p.