by Kastro
Paper/Archive/CVE-2023-41387

CVE-2023-41387

patreon flutter_downloader — A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite…

EPSS 0.9%public exploitCVSS 9.1
critical.is priorityof 100
49
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.0.590 × 2011.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A SQL injection in the flutter_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arbitrary files inside the app's container. The internal database of the framework is exposed to the local user if an app uses UIFileSharingEnabled and LSSupportsOpeningDocumentsInPlace properties. As a result, local users can obtain the same attack primitives as remote attackers by tampering with the internal database of the framework on the device.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
flutter_downloader≤ 1.11.1–CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refpub.dev/packages/flutter_downloader/changelogrefseredynski.com/articles/exploiting-ios-apps-to-extract-session-tokens-and-overwrite-user-data