CVE-2023-27648
📋 TL;DR
This CVE describes a directory traversal vulnerability in T-ME Studios' 'Change Color of Keypad' Android app that allows remote attackers to execute arbitrary code by manipulating dex files in internal storage. The vulnerability affects users of the vulnerable app version on Android devices. Attackers can exploit this to gain control of affected devices.
💻 Affected Systems
- T-ME Studios Change Color of Keypad Android app
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing data theft, ransomware deployment, botnet enrollment, and persistent backdoor installation.
Likely Case
Malicious code execution leading to data exfiltration, credential theft, and unauthorized access to device resources.
If Mitigated
Limited impact with proper app sandboxing and security controls, potentially preventing full device compromise.
🎯 Exploit Status
Directory traversal vulnerabilities are typically easy to exploit once identified, and public details exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check Google Play Store for updates
Vendor Advisory: https://corporate.timmystudios.com/
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for 'Change Color of Keypad' 3. Check for available updates 4. Install any available update 5. Restart device
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove the vulnerable application from affected devices
adb uninstall com.jb.gokeyboard.theme.twchangecolorofkeypad
🧯 If You Can't Patch
- Disable or remove the vulnerable app from all devices
- Implement network segmentation to isolate affected devices and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > Change Color of Keypad > App infoCheck Version:
adb shell dumpsys package com.jb.gokeyboard.theme.twchangecolorofkeypad | grep versionNameVerify Fix Applied:
Verify app version is updated beyond v1.275.1.277 in Google Play Store📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in internal storage
- Suspicious dex file modifications
Network Indicators:
- Unexpected outbound connections from keyboard app
- Data exfiltration patterns
SIEM Query:
source="android_logs" app="com.jb.gokeyboard.theme.twchangecolorofkeypad" (event="file_access" OR event="dex_load")🔗 References
- https://corporate.timmystudios.com/
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27648/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.jb.gokeyboard.theme.twchangecolorofkeypad
- https://corporate.timmystudios.com/
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27648/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.jb.gokeyboard.theme.twchangecolorofkeypad
