CVE-2023-27654
📋 TL;DR
This vulnerability in WHO app versions 1.0.28, 1.0.30, and 1.0.32 allows attackers to escalate privileges via the TTMultiProvider component. Attackers could gain elevated access to perform unauthorized actions within the app. Users of these specific WHO app versions on Android are affected.
💻 Affected Systems
- WHO app
📦 What is this software?
Who by Whoapp
Who by Whoapp
Who by Whoapp
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of app functionality, unauthorized access to user data, and potential device takeover if combined with other vulnerabilities.
Likely Case
Unauthorized access to app features and user data, manipulation of app settings, and potential financial or privacy impact.
If Mitigated
Limited impact with proper app sandboxing and minimal permissions, though some app-specific data could still be compromised.
🎯 Exploit Status
Exploitation requires local access to the device and the vulnerable app installed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.0.32
Vendor Advisory: https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27654/CVE%20detail.md
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for 'WHO' app 3. Check current version 4. If version is 1.0.28, 1.0.30, or 1.0.32, update to latest version 5. Restart device after update
🔧 Temporary Workarounds
Uninstall vulnerable app
androidRemove the vulnerable WHO app version from the device
adb uninstall com.scorp.who
Restrict app permissions
androidLimit app permissions to minimum required functionality
🧯 If You Can't Patch
- Uninstall the WHO app completely
- Use alternative secure communication apps
🔍 How to Verify
Check if Vulnerable:
Check app version in Settings > Apps > WHO > App infoCheck Version:
adb shell dumpsys package com.scorp.who | grep versionNameVerify Fix Applied:
Verify app version is higher than 1.0.32 in Google Play Store📡 Detection & Monitoring
Log Indicators:
- Unusual permission requests from WHO app
- Suspicious activity in app logs
Network Indicators:
- Unexpected network traffic from WHO app
SIEM Query:
app.name:"WHO" AND version:"1.0.28" OR version:"1.0.30" OR version:"1.0.32"🔗 References
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27654/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.scorp.who
- https://www.whoapp.live/
- https://github.com/LianKee/SODA/blob/main/CVEs/CVE-2023-27654/CVE%20detail.md
- https://play.google.com/store/apps/details?id=com.scorp.who
- https://www.whoapp.live/
