GHSA-3hpf-ff72-j67p shared_preferences_android vulnerability
An attacker with local file write access can overwrite preference files to trigger arbitrary code execution via unsafe deserialization in the shared_preferences_android library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-3hpf-ff72-j67p?
GHSA-3hpf-ff72-j67p is an unsafe deserialization vulnerability in shared_preferences_android, published on 6 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Impact
Due to some data types not being natively representable for the available storage options, shared_preferences_android serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code execution.
As a result, Files containing the preferences can be overwritten with a malicious one with a deserialization payload that triggers as soon as the data is loaded from the disk.
Patches
2.3.4
Workarounds
Update to the latest version of shared_preferences_android that contains the changes to address this vulnerability.
References
TBD
For more information
See our community page to find ways to contact the team.
Thanks
Thank you so much to Oskar Zeino-Mahmalat from sonarsource for finding and reporting this issue!
Which versions are affected by GHSA-3hpf-ff72-j67p?
2 open source packages ship an affected version, including shared_preferences_android.
| Package | Affected | Fixed in |
|---|---|---|
shared_preferences_android Pub | From 2.3.3 | 2.3.4 |
shared_preferences_android Pub | From 2.3.3 | 2.3.4 |
How do I fix GHSA-3hpf-ff72-j67p?
Upgrade shared_preferences_android to 2.3.4 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-3hpf-ff72-j67p being exploited?
There is no known exploitation of GHSA-3hpf-ff72-j67p in the wild and no public exploit code.