CVE-2023-27651
📋 TL;DR
This vulnerability in Ego Studio SuperClean allows attackers to escalate privileges by manipulating the update_info field in the _default_.xml file. It affects users of SuperClean v1.1.9 and v1.1.5 on Android devices, potentially enabling unauthorized access to system functions.
💻 Affected Systems
- Ego Studio SuperClean (Phone Cleaner)
📦 What is this software?
Superclean by Egostudiogroup
Superclean by Egostudiogroup
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise with attacker gaining root/system-level privileges, allowing installation of malware, data theft, or complete device control.
Likely Case
Local privilege escalation enabling unauthorized access to sensitive app data or system functions beyond normal user permissions.
If Mitigated
Limited impact with proper app sandboxing and security controls preventing privilege escalation attempts.
🎯 Exploit Status
Exploitation requires local access to modify the XML file. GitHub repository contains technical details and proof-of-concept information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://www.egostudiogroup.com/
Restart Required: No
Instructions:
1. Check for app updates in Google Play Store or app marketplace
2. If update available, install latest version
3. If no update, consider alternative cleaning apps
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove SuperClean from affected devices to eliminate the vulnerability
adb uninstall com.egostudio.clean
Restrict app permissions
androidLimit app permissions to minimum required functionality
🧯 If You Can't Patch
- Monitor for suspicious privilege escalation attempts using Android security tools
- Implement mobile device management (MDM) to control app installations and permissions
🔍 How to Verify
Check if Vulnerable:
Check app version in Android Settings > Apps > SuperClean > App infoCheck Version:
adb shell dumpsys package com.egostudio.clean | grep versionNameVerify Fix Applied:
Verify app version is higher than v1.1.9 or app has been removed📡 Detection & Monitoring
Log Indicators:
- Unexpected modifications to _default_.xml file
- Privilege escalation attempts in app logs
Network Indicators:
- Unusual update requests from SuperClean app
SIEM Query:
app:"SuperClean" AND (event:"privilege_escalation" OR file_modification:"_default_.xml")🔗 References
- http://www.egostudiogroup.com/
- https://apkpure.com/cn/super-clean-phone-cleaner/com.egostudio.clean/download
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27651/CVE%20detail.md
- http://www.egostudiogroup.com/
- https://apkpure.com/cn/super-clean-phone-cleaner/com.egostudio.clean/download
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27651/CVE%20detail.md
