CVE-2023-27650
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on devices running vulnerable versions of APUS Group Launcher by exploiting the FONT_FILE parameter. It affects users of APUS Launcher versions 3.10.73 and 3.10.88 on Android devices. The high CVSS score indicates critical severity with network-accessible attack vectors.
💻 Affected Systems
- APUS Group Launcher
📦 What is this software?
Launcher by Apusapps
Launcher by Apusapps
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install malware, steal sensitive data, gain persistent access, and use device as part of botnet.
Likely Case
Remote code execution leading to data theft, unauthorized app installation, or device takeover for malicious activities.
If Mitigated
Attack blocked at network perimeter or by app sandboxing, limiting impact to isolated app context.
🎯 Exploit Status
Public exploit details available in GitHub repository. Remote exploitation without authentication makes weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.10.88
Vendor Advisory: https://www.apusapps.com/en/launcher
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for APUS Launcher 3. Update to latest version 4. Restart device to ensure patch is fully applied
🔧 Temporary Workarounds
Disable APUS Launcher
androidChange default launcher to stock Android or trusted alternative launcher
Settings > Apps > Default apps > Home app > Select alternative launcher
Network Blocking
androidBlock network access to APUS Launcher using firewall or network policies
adb shell pm disable com.apusapps.launcher (requires USB debugging enabled)
🧯 If You Can't Patch
- Uninstall APUS Launcher completely and use alternative launcher
- Implement strict network segmentation to isolate affected devices from critical resources
🔍 How to Verify
Check if Vulnerable:
Check APUS Launcher version in Settings > Apps > APUS Launcher > App infoCheck Version:
adb shell dumpsys package com.apusapps.launcher | grep versionNameVerify Fix Applied:
Verify version is newer than 3.10.88 and test with known exploit payloads📡 Detection & Monitoring
Log Indicators:
- Unusual font file loading attempts
- APUS Launcher crash logs with suspicious parameters
- Unexpected process execution from launcher context
Network Indicators:
- Suspicious network requests to APUS servers with font parameters
- Unexpected outbound connections from launcher process
SIEM Query:
process_name:"APUS Launcher" AND (event_type:crash OR param_name:"FONT_FILE")🔗 References
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27650/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.apusapps.launcher
- https://www.apusapps.com/en/launcher
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27650/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.apusapps.launcher
- https://www.apusapps.com/en/launcher
