[Original post here: https://wwws.nightwatchcybersecurity.com/2018/03/01/content-injection-in-samsung-display-solutions-application-for-android-cve-2018-6019/] TITLE Content Injection in Samsung Display Solutions Application for Android [CVE-2018-6019] SUMMARY Samsung Display Solutions App for Android did not use encryption (SSL) for information transmission, thus allowing an MITM attacker to inject their own content into the app. The vendor fixed this issue and users should install the latest version (3.02 or above). MITRE has assigned CVE-2018-6019 to track this issue. DETAILS Samsung makes an Android application that allows users to browse B2B content related to Samsungas display products. While performing network level testing, we discovered that the content shown in the app was loaded via server calls made by the application without any kind of encryption (SSL). This allowed an MITM attacker to inject their own content into the app. To observe the issue on v3.01: 1. Install the application on the device. 2. Setup an MITM proxy but do not install the SSL certificate on the device (we used PacketCapture). 3. Start the proxy. At this point all network traffic will be going through the proxy with the SSL traffic being encrypted by a self-signed certificate which is not trusted by the device. 4. Open the app. 5. Go back to the proxy and observe captured traffic. All testing was done on Android 7 and application version 3.01. Network captures were performed using an on-device proxy (PacketCapture) without a trusted SSL certificate. VENDOR RESPONSE The vendor fixed this issue and users should install the latest version (3.02 or above). REFERENCES CVE ID: CVE-2018-6019 Google Play Link: https://play.google.com/store/apps/details?id=com.sds.samsung.global BOUNTY INFORMATION This issue was originally reported to the Samsung Mobile Security Bounty Program but was deemed to be out of scope. However, after being transferred to the Display Solutions team, this issue qualified for the Samsung TV Bounty Program. CREDITS Advisory written by Yakov Shafranovich. TIMELINE 2017-09-09: Reported to Samsung Mobile Security bounty program 2017-09-09: Automated response from the vendor received 2017-10-18: Engineer assigned to the issue 2017-11-19: Deemed out of scope; reply sent 2017-11-25: Vendor requests additional information; reply sent 2017-11-27: Issue rejected, public disclosure requested 2017-12-06: Reply from vendor received, additional information requested; reply sent 2017-12-07: Additional information requested by the vendor 2017-12-09: Reply sent with screenshots 2018-01-08: Vendor accepts the issue as in scope, and plans remediation 2018-01-11: Issue transferred to the Samsung TV bounty program 2018-01-14: Fixed version released 2018-01-22: CVE requested and received from MITRE 2018-02-14: Vendor requests confirmation of the fix, fix confirmed and reply sent 2018-03-25: Draft advisory sent to vendor for review; bounty payment received 2018-03-01: Public disclosure