Amazon Fixes High-severity Vulnerability in Android Photos App

Amazon has confirmed and fixed a vulnerability in its Photos app for Android, which has been downloaded over 50 million times on the Google Play Store.

Amazon Photos is an image and video storage application that enables users to seamlessly share their snaps with up to five family members, offering powerful management and organization features.

The flaw, discovered by researchers at Checkmarx, lies in a misconfiguration of an app component, resulting in its manifest file being externally accessible without authentication.

Also Read: The Competency Framework: A Guide for Managers and Staff

Exploiting this bug could have enabled a malicious app installed on the same device to snatch Amazon access tokens used for Amazon APIs authentication.

These APIs might contain sensitive personal information like full name, email, and physical address, while others like the Amazon Drive API hold user files.

Exploiting the flaw

The vulnerable component is “com.amazon.gallery.thor.app.activity.ThorViewActivity”, which, when launched, triggers an HTTP request that contains a header with the user’s token.

Checkmarx researchers found that an external app could easily launch the vulnerable activity and trigger the request at will, sending the token to an actor-controlled server.

The analysts explored various exploitation scenarios with the acquired token, such as performing file actions on the victim’s Amazon Drive cloud storage, erasing history so that deleted data is irrecoverable, and more.

“With all these options available for an attacker, a ransomware scenario was easy to come up with as a likely attack vector,” details Checkmarx

Also Read: Personal Data Protection Act Australia

“A malicious actor would simply need to read, encrypt, and re-write the customer’s files while erasing their history.”

The same token might be used by other Amazon APIs, like Prime Video, Alexa, Kindle, etc., so the exploitation potential could be far-reaching.