Cache Configuration Issue in WhatsApp for Android Affects External Storage Access
CVE-2021-24027

7.5HIGH

Key Information:

Vendor

Facebook

Status
WhatSAPp Business For Android
WhatSAPp For Android
Vendor
CVE Published:
6 April 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 15%

What is CVE-2021-24027?

A cache configuration issue in WhatsApp for Android versions prior to v2.21.4.18 could allow unauthorized access to cached TLS material. This vulnerability may enable third parties with access to the device's external storage to read sensitive information, potentially compromising user privacy and security. Users are advised to update their applications to the latest version to mitigate this risk.

Affected Version(s)

WhatsApp Business for Android v2.21.4.18

WhatsApp for Android < unspecified

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

whatsapp-mitd-mitm
Created by CENSUS

References

https://www.whatsapp.com/security/advisories/2021/
x_refsource_CONFIRM

EPSS Score

15% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.