CVE-2023-33293 : Security Advisory and Response

An issue was discovered in KaiOS 3.0 and 3.1 where the binary /system/kaios/api-daemon exposes a local web server on *.localhost with subdomains for each installed application. This vulnerability allows an attacker to make fetch requests to api-daemon to identify if a specific app is installed and access the manifest.webmanifest contents, including the app version.

Understanding CVE-2023-33293

This section delves into the details of the CVE-2023-33293 vulnerability found in KaiOS 3.0 and 3.1.

What is CVE-2023-33293?

CVE-2023-33293 is a security flaw present in KaiOS 3.0 and 3.1 that exposes a local web server on *.localhost, allowing unauthorized access to information about installed applications.

The Impact of CVE-2023-33293

This vulnerability enables attackers to determine the existence of specific apps and access sensitive app version information, posing a risk to user privacy and security.

Technical Details of CVE-2023-33293

This section provides technical insights into the CVE-2023-33293 vulnerability.

Vulnerability Description

The flaw in KaiOS 3.0 and 3.1 exposes a local web server, enabling attackers to fetch requests to api-daemon and extract details about installed applications.

Affected Systems and Versions

KaiOS 3.0 and 3.1 are impacted by this vulnerability, potentially affecting devices running these versions.

Exploitation Mechanism

Attackers exploit this vulnerability by sending fetch requests to the api-daemon to disclose information about installed apps and their versions.

Mitigation and Prevention

Learn how to address and prevent the CVE-2023-33293 vulnerability in KaiOS.

Immediate Steps to Take

Users should exercise caution while interacting with unknown sources or applications to mitigate the risk of unauthorized access.

Long-Term Security Practices

Implementing strict application permissions and regularly updating the system can enhance overall security against similar vulnerabilities.

Patching and Updates

Ensure that devices running KaiOS 3.0 and 3.1 are updated with the latest patches and security fixes to address CVE-2023-33293.