what you don't know can hurt you

Framer Preview 12 Content Injection

Framer Preview 12 Content Injection
Posted Sep 22, 2020
Authored by Julien Ahrens | Site rcesecurity.com

Framer Preview version 12 for Android exposes an activity to other apps called "com.framer.viewer.FramerViewActivity". The purpose of this activity is to show contents of a given URL via an fullscreen overlay to the app user. However, the app does neither enforce any authorization schema on the activity nor does it validate the given URL.

tags | advisory
advisories | CVE-2020-25203
MD5 | e8924ed5ec5837a0e6f0ebe0b7cfd700

Framer Preview 12 Content Injection

Change Mirror Download
RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product: Framer Preview
Vendor URL: https://play.google.com/store/apps/details?id=com.framerjs.android
Type: Improper Export of Android Application Components [CWE-926]
Date found: 2020-09-06
Date published: 2020-09-22
CVSSv3 Score: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
CVE: CVE-2020-25203


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
Framer Preview 12


4. INTRODUCTION
===============
Framer Preview is the best way to view and interact with your Framer X and Framer
Classic projects on Android phones and tablets.

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
The "Framer Preview" app for Android exposes an activity to other apps called
"com.framer.viewer.FramerViewActivity". The purpose of this activity is to show
contents of a given URL via an fullscreen overlay to the app user.

However, the app does neither enforce any authorization schema on the activity
nor does it validate the given URL.

This can be abused by an attacker (malicious app) to load any website/web content
into the fullscreen overlay. An exemplary exploit could look like the following:

Intent i = new Intent();
i.setComponent(new ComponentName("com.framerjs.android", "com.framer.viewer.FramerViewActivity"));
i.setAction("android.intent.action.VIEW");
i.setData(Uri.parse("https://www.rcesecurity.com"));
startActivity(i);


6. RISK
=======
A malicious app on the same device is able to exploit this vulnerability to lead
the user to any webpage/content. The specific problem here is the assumed trust
boundary between the user having the Framer Preview app installed and what the app
is actually doing/displaying to the user. So if the user sees the app being
loaded and automatically loading another page, it can be assumed that the loaded
page is also trusted by the user.


7. SOLUTION
===========
-


8. REPORT TIMELINE
==================
2020-09-06: Discovery of the vulnerability
2020-09-06: CVE requested from MITRE
2020-09-07: Contacted vendor via their security@, no response
2020-09-08: MITRE assigns CVE-2020-25203
2020-09-09: Informed vendor about the CVE assignment, no response
2020-09-22: Public disclosure due to unresponsive vendor


9. REFERENCES
=============
-


Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    1 Files
  • 26
    Oct 26th
    17 Files
  • 27
    Oct 27th
    19 Files
  • 28
    Oct 28th
    29 Files
  • 29
    Oct 29th
    13 Files
  • 30
    Oct 30th
    8 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close