CVE-2022-47757
📋 TL;DR
A path traversal vulnerability in imo.im allows attackers to write malicious shared libraries to the application's data directory via unsanitized deeplinks. When the app loads these libraries, it can lead to arbitrary code execution. All users of the affected imo.im version are vulnerable.
💻 Affected Systems
- imo.im
📦 What is this software?
Imo by Imo
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution, potentially allowing complete control of the device and access to all application data.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive user data, message history, and contacts within the imo.im application.
If Mitigated
Limited impact with proper file system permissions and application sandboxing, potentially preventing successful exploitation.
🎯 Exploit Status
Exploitation requires user to click a malicious deeplink. The vulnerability is well-documented in public advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions after 2022.11.1051
Vendor Advisory: https://github.com/Ch0pin/security-advisories/security/advisories/GHSA-ghf9-x3c5-3mwj
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for imo.im 3. Update to latest version 4. Restart the application
🔧 Temporary Workarounds
Disable deeplink handling
androidPrevent imo.im from handling deeplinks by modifying app settings or using Android app settings.
Network filtering
allBlock malicious deeplink URLs at network perimeter or DNS level.
🧯 If You Can't Patch
- Uninstall imo.im application from affected devices
- Implement strict network filtering to block known malicious deeplink URLs
🔍 How to Verify
Check if Vulnerable:
Check imo.im version in app settings. If version is 2022.11.1051, the system is vulnerable.Check Version:
Check in Android Settings > Apps > imo.im > App infoVerify Fix Applied:
Verify imo.im version is newer than 2022.11.1051 in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations in imo.im data directory
- Suspicious deeplink URL processing
Network Indicators:
- HTTP requests to unusual domains containing deeplink parameters
- Suspicious URL patterns in network traffic
SIEM Query:
source="imo.im" AND (event="file_write" OR event="deeplink_processed")