Two security flaws have been discovered in Samsung’s Galaxy Store app for Android. A local attacker could exploit this vulnerability to covertly install arbitrary apps or direct victims to malicious landing pages on her web.
The issue is tracked as CVE-2023-21433 and CVE-2023-21434, was discovered by NCC Group and notified to South Korean conglomerates in November and December 2022. Samsung classified the bug as medium risk and released a fix in version 188.8.131.52, which shipped earlier this month.
The Samsung Galaxy Store, formerly known as Samsung Apps and Galaxy Apps, is an app store exclusively for Android devices manufactured by Samsung. Released in September 2009.
The first of the two vulnerabilities, CVE-2023-21433, could allow a malicious Android app already installed on Samsung devices to install arbitrary applications available in the Galaxy Store.
Samsung explained that it was a case of improper access controls, which it said was patched with proper permissions to prevent unauthorized access.
Note that this drawback only affects Samsung devices running Android 12 and lower, not devices with the latest version (Android 13).
The second vulnerability, CVE-2023-21434, is related to an instance of improper input validation when restricting the list of domains that can be launched as a WebView from within an app, allowing an attacker to bypass filters. and domains under their control.
“Tapping a malicious hyperlink in Google Chrome or tapping a malicious application pre-installed on a Samsung device can bypass Samsung’s URL filters and launch a web view to an attacker-controlled domain. said NCC Group researcher Ken Gannon.
This update came when Samsung rolled out a security update in January 2023 to fix several flaws. Some of them can be used to modify carrier network parameters, control his BLE advertisements without permission, and execute arbitrary code.