SHAREit up to 4.0.35 on Android improper authentication

Summaryinfo

A vulnerability labeled as critical has been found in SHAREit up to 4.0.35 on Android. The impacted element is an unknown function. Such manipulation leads to improper authentication. This vulnerability is listed as CVE-2019-9939. The attack must be carried out from within the local network. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in SHAREit up to 4.0.35 on Android (Android App Software). It has been rated as critical. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The SHAREit application before 4.0.36 for Android allows a remote attacker (on the same network or joining public "open" Wi-Fi hotspots created by the application when file transfer is initiated) to bypass authentication by trying to fetch a non-existing page. When the non-existing page is requested, the application responds with a 200 status code and empty page, and adds the requesting client device into the list of recognized devices.

The bug was discovered 02/27/2019. The weakness was presented 03/22/2019. This vulnerability is handled as CVE-2019-9939 since 03/22/2019. The attack needs to be done within the local network. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 23 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.0.36 eliminates this vulnerability.

See VDB-132127 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Android App Software

Name

• SHAREit

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.14
• 4.0.15
• 4.0.16
• 4.0.17
• 4.0.18
• 4.0.19
• 4.0.20
• 4.0.21
• 4.0.22
• 4.0.23
• 4.0.24
• 4.0.25
• 4.0.26
• 4.0.27
• 4.0.28
• 4.0.29
• 4.0.30
• 4.0.31
• 4.0.32
• 4.0.33
• 4.0.34
• 4.0.35

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion