Vulnerability · Published Feb 20, 2024 · Assigned by GitHub_M

CVE-2024-26132Element Android can be asked to share internal files.

Medium 4.0

In plain English

A medium-severity information exposure in element-android from element-hq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.0Medium

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application's private data directory to an arbitrary room. The impact of the attack is reduced by the fact that the databases stored in this folder are encrypted. However, it contains some other potentially sensitive information, such as the FCM token. Forks of Element Android which have set `android:exported="false"` in the `AndroidManifest.xml` file for the `IncomingShareActivity` activity are not impacted. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Affected products (as reported)

Vendor	Product	Versions
element-hq	element-android	>= 0.91.0, < 1.6.12

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/element-hq/element-android/security/advisories/GHSA-8wj9-cx7h-pvm4 x_refsource_CONFIRM
https://github.com/element-hq/element-android/commit/8f9695a9a8d944cb9b92568cbd76578c51d32e07 x_refsource_MISC
https://element.io/blog/security-release-element-android-1-6-12 x_refsource_MISC