CVE-2023-27645
📋 TL;DR
A privilege escalation vulnerability in POWERAMP audio player allows remote attackers to gain elevated privileges by manipulating reverb and EQ preset parameters. This affects users of POWERAMP build 925 and 954 on Android devices. Attackers could potentially execute arbitrary code with app permissions.
💻 Affected Systems
- POWERAMP Audio Player
📦 What is this software?
Poweramp by Powerampapp
Poweramp by Powerampapp
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full control of the POWERAMP app, potentially accessing device audio files, modifying settings, or using app permissions for further system compromise.
Likely Case
Attacker gains elevated privileges within the POWERAMP app, allowing manipulation of audio settings, access to stored audio files, and potential data exfiltration.
If Mitigated
With proper app sandboxing and minimal permissions, impact limited to POWERAMP app functionality without system-wide compromise.
🎯 Exploit Status
Exploitation requires user to open malicious audio file or content. Public details available in GitHub repository references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later builds after 954
Vendor Advisory: https://powerampapp.com/
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for POWERAMP 3. Update to latest version 4. Restart device if prompted
🔧 Temporary Workarounds
Disable automatic audio file processing
androidPrevent automatic processing of audio files from untrusted sources
Temporary app disable
androidDisable POWERAMP until patched if high risk environment
🧯 If You Can't Patch
- Uninstall POWERAMP if not essential
- Restrict app permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Check POWERAMP version in app settings: Settings > About. Vulnerable if version shows build 925 or 954.Check Version:
Not applicable - check via Android app settingsVerify Fix Applied:
Update via Google Play Store and verify version is newer than build 954.📡 Detection & Monitoring
Log Indicators:
- Unusual audio file processing
- POWERAMP crash logs with privilege errors
- Unexpected permission requests
Network Indicators:
- Downloads of suspicious audio files
- Network traffic to POWERAMP from untrusted sources
SIEM Query:
Not applicable for typical mobile app monitoring🔗 References
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27645/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.maxmpz.audioplayer
- https://powerampapp.com/
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27645/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.maxmpz.audioplayer
- https://powerampapp.com/
