Summary and impact
NewPipe is an Android app written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions up to NewPipe 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serialization Stream Protocol, which can allow constructing any class in the app, unless properly restricted.
To exploit this vulnerability, an attacker would need to build a backup file containing the exploit, and then persuade a user into importing it. During the import process, the malicious code would be executed, possibly crashing the app, stealing user data from the NewPipe app, performing nasty actions through Android APIs, and attempting Android JVM/Sandbox escapes through vulnerabilities in the Android OS.
The attack can take place only if the user imports a malicious backup file, so an attacker would need to trick a user into importing a backup file from a source they can control. The implementation details of the malicious backup file can be independent of the attacked user or the device they are being run on, and do not require additional privileges.
Affected versions and remediation options
All NewPipe versions from 0.13.4 to 0.26.1 are vulnerable.
NewPipe version 0.27.0 fixes the issue by doing the following:
- Restrict the classes that can be deserialized when calling Java's Object Serialization Stream Protocol, by adding a whitelist with only innocuous data-only classes that can't lead to Abitrary Code Execution:
Boolean, Byte, Character, Short, Integer, Long, Float, Double, Void, HashMap, HashSet (see cmu.edu, OWASP cheatsheet and Apache's ValidatingObjectInputStream )
- Deprecate backups serialized with Java's Object Serialization Stream Protocol
- Use JSON serialization for all newly created backups (but still include an alternative file serialized with Java's Object Serialization Stream Protocol in the backup zip for backwards compatibility)
- Show a warning to the user when attempting to import a backup where the only available serialization mode is Java's Object Serialization Stream Protocol (note that in the future this serialization mode will be removed completely)
More details
NewPipe backups are a .zip with two files:
- SQLite database (not relevant for this vulnerability)
- settings (an exploit can be embedded here)
During the import process, an ObjectInputStream object is used to deserialize the contents of the settings file (see the code). In order for the vulnerability to be exploited, the attacker needs to find a class that allows code execution when deserialized. Note that the attacker cannot define a custom Java class within the settings file for this purpose, because Android DEX doesn't allow creating classes at runtime.
The reporter @litetex provided a Proof of Concept of the exploit, with a malicious backup that runs System.exit(1337) when imported.
CVSS score
The potential CVSS score would be 8.5 (High). Here is a breakdown according to https://www.first.org/cvss/v3.1/user-guide#Scoring-Rubrics :
| Category |
Value |
Why? |
| Attack vector |
Local |
The user needs to be tricked into importing the malicious settings |
| Attack complexity |
Low |
No special conditions exists, the attack works repeatably |
| User interaction |
Required |
The user needs to be tricked into importing the malicious settings |
| Privileges Required |
None |
- |
| Scope |
Changed |
The exploit can be used to gain further access / run any code |
| Confidentiality |
High |
All resources of NewPipe can be modified or stolen |
| Integrity |
High |
All resources of NewPipe can be modified or stolen |
| Availability |
Low |
An attacker can crash the app once |
Credits
All credits for the discovery of this vulnerability go to @litetex, who also provided a Proof of Concept exploit to the NewPipe team and an initial fix attempt in #9887. The final fix for the vulnerability was provided by @Stypox along with the help of the NewPipe team.
litetex Reporter
Summary and impact
NewPipe is an Android app written in Java. It supports exporting and importing backups, as a way to let users move their data to a new device effortlessly. However, in versions up to NewPipe 0.26.1, importing a backup file from an untrusted source could have resulted in Arbitrary Code Execution. This is because backups are serialized/deserialized using Java's Object Serialization Stream Protocol, which can allow constructing any class in the app, unless properly restricted.
To exploit this vulnerability, an attacker would need to build a backup file containing the exploit, and then persuade a user into importing it. During the import process, the malicious code would be executed, possibly crashing the app, stealing user data from the NewPipe app, performing nasty actions through Android APIs, and attempting Android JVM/Sandbox escapes through vulnerabilities in the Android OS.
The attack can take place only if the user imports a malicious backup file, so an attacker would need to trick a user into importing a backup file from a source they can control. The implementation details of the malicious backup file can be independent of the attacked user or the device they are being run on, and do not require additional privileges.
Affected versions and remediation options
All NewPipe versions from 0.13.4 to 0.26.1 are vulnerable.
NewPipe version 0.27.0 fixes the issue by doing the following:
Boolean,Byte,Character,Short,Integer,Long,Float,Double,Void,HashMap,HashSet(see cmu.edu, OWASP cheatsheet and Apache'sValidatingObjectInputStream)More details
NewPipe backups are a
.zipwith two files:During the import process, an
ObjectInputStreamobject is used to deserialize the contents of the settings file (see the code). In order for the vulnerability to be exploited, the attacker needs to find a class that allows code execution when deserialized. Note that the attacker cannot define a custom Java class within the settings file for this purpose, because Android DEX doesn't allow creating classes at runtime.The reporter @litetex provided a Proof of Concept of the exploit, with a malicious backup that runs
System.exit(1337)when imported.CVSS score
The potential CVSS score would be 8.5 (High). Here is a breakdown according to https://www.first.org/cvss/v3.1/user-guide#Scoring-Rubrics :
Credits
All credits for the discovery of this vulnerability go to @litetex, who also provided a Proof of Concept exploit to the NewPipe team and an initial fix attempt in #9887. The final fix for the vulnerability was provided by @Stypox along with the help of the NewPipe team.