Samsung Galaxy Store's critical auto apps installation flaws

[TheFastestIndian]

Researchers from the NCC Group discovered two CVEs in Samsung’s official app store. As detailed by the researchers, these two flaws in Samsung Galaxy Store could enable attackers to install any app without the user’s knowledge or to direct victims to a malicious web location.

Fixed with Samsung Galaxy Store app version 4.5.49.8, the flaws were discovered by NCC Group researchers between November 23 and December 3, 2022. In a recent development, researchers at NCC Group disclosed (via Mishaal Rahman) technical details for the two security issues with proof-of-concept.

These CVEs could not have affected devices running the latest Android 13-based One UI 5. As noted in the report, a pre-installed rouge application on a Samsung device running Android 12 or below can abuse this issue to install any application currently available on Galaxy App Store.

In order to fix these CVEs, the South Korean tech giant has pushed an updated version of the Galaxy Store (version 4.5.49.8).

NCC Group found that “a webview within the Galaxy App Store contained a filter that limited which domains that webview could browse to.” Regardless the developers have not correctly configured it, which would allow the webview to browse to an attacker-controlled domain.

Galaxy Store CVEs:

Technical Advisory: Improper access control could allow local attackers to install applications from the Galaxy App Store (CVE-2023-21433)

Technical Advisory: Improper input validation could allow local attackers to execute JavaScript by launching a web page (CVE-2023-21434)

Proof-of-concept

[Anonymous]

I never understand why these OEMs have their own app store. Atleast with MIUI, Color OS if you debloat their app store, you will still receive system app updates as the updates are pushed OTA. However, Samsung made sure no system apps will get updates if you debloat their app store. This is shady af.

[TheFastestIndian]

Samsung is trying to make their own ecosystem

[Anonymous]

What does the Samsung app store have to do Samsung ecosystem? Samsung could have just released their apps on Google Play Store and push updates through Google Play store.

[TheFastestIndian]

Samsung is trying to make app updates from Galaxy Store instead of Play Store as that is from Google. Once all app updates from Samsung galaxy Store, play store will not be required meaning GMS will not be required and that's how they will be able to create their own ecosystem. As of now their dependency is on Google and Samsung is trying to remove that