Security News > 2020 > December > Android devs: If you're using the Google Play Core Library, update it against this remote file inclusion CVE. Pronto
Infosec bods from Check Point have discovered that popular apps are still running outdated versions of Google's Play Core library for Android - versions that contained a remote file inclusion vulnerability.
They found that the Play Core Library, an in-app update and streamlining feature offered to Android devs, could be abused to "Add executable modules to any apps using the library".
Aviran Hazum, Check Point's mobile research manager, said in a statement: "Although Google implemented a patch, many apps are still using outdated Play Core libraries. The vulnerability CVE-2020-8913 is highly dangerous. If a malicious application exploits this vulnerability, it can gain code execution inside popular applications, obtaining the same access as the vulnerable application... a threat actor could inject code into social media applications to spy on victims or inject code into IM apps to grab all messages. The attack possibilities here are only limited by a threat actor's imagination."
The Google Play Core Library, as Oversecured summarised it at the vuln's disclosure in August, "Allows updates to various parts of an app to be delivered at runtime without the participation of the user, via the Google API." It also allows app devs to shrink the size of.
While the immediate impact of this should have been low given that Google patched the library months ago, mobile developers who haven't updated their Google Play Core Library implementations since April should do so immediately - and slap themselves on the wrists if they haven't already done that thing.
News URL
Related news
- Android malware 'Necro' infects 11 million devices via Google Play (source)
- Fake WalletConnect app on Google Play steals Android users’ crypto (source)
- New Octo Android malware version impersonates NordVPN, Google Chrome (source)
- Google's Shift to Rust Programming Cuts Android Memory Vulnerabilities by 68% (source)
- Google sees 68% drop in Android memory safety flaws over 5 years (source)
- Fake Trading Apps Target Victims Globally via Apple App Store and Google Play (source)
- ‘Pig butchering’ trading apps found on Google Play, App Store (source)
- Google Blocks Unsafe Android App Sideloading in India for Improved Fraud Protection (source)
- Google brings better bricking to Androids, to curtail crims (source)
- Over 200 malicious apps on Google Play downloaded millions of times (source)
Related Vulnerability
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2020-08-12 | CVE-2020-8913 | Path Traversal vulnerability in Android Play Core Library A local, arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. | 8.8 |