Remote Code Execution in Samsung Galaxy Apps due to Hostname Modification Vulnerability

CVE-2018-20135

Summary

An issue in Samsung Galaxy Apps prior to version 4.4.01.7 allows attackers to exploit a vulnerability related to hostname modification during application installation. By executing a man-in-the-middle attack, an attacker can trick the app into using an arbitrary hostname for which a valid SSL certificate can be provided. This flaw permits the emulation of the app store's API, enabling modification of applications at installation time. The vulnerability arises from an HTTP method that retrieves the load-balanced hostname but only enforces SSL validation post-hostname acquisition. Additionally, the absence of app signature validation in the application XML exacerbates the risk, potentially leading to remote code execution on the device.

References