CVE-2024-49421
📋 TL;DR
This CVE describes a path traversal vulnerability in Samsung's Quick Share Agent on Android devices. It allows adjacent attackers (on the same network) to write files to arbitrary locations on vulnerable devices. Affected users are those running Android 12, 13, or 14 with Quick Share Agent versions below the patched releases.
💻 Affected Systems
- Samsung Quick Share Agent
📦 What is this software?
Quick Share by Samsung
Quick Share by Samsung
Quick Share by Samsung
⚠️ Risk & Real-World Impact
Worst Case
An attacker could overwrite critical system files, potentially leading to device compromise, data corruption, or denial of service.
Likely Case
Local file manipulation leading to data leakage, privilege escalation, or installation of malicious files.
If Mitigated
Limited impact due to network adjacency requirement and file write restrictions.
🎯 Exploit Status
Adjacent network access required; no authentication needed for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.14.47 for Android 12, 3.5.19.41 for Android 13, 3.5.19.42 for Android 14
Vendor Advisory: https://security.samsungmobile.com/serviceWeb.smsb?year=2024&month=12
Restart Required: No
Instructions:
1. Open device Settings. 2. Navigate to Software Update. 3. Check for and install available updates. 4. Verify Quick Share Agent version after update.
🔧 Temporary Workarounds
Disable Quick Share
androidTemporarily disable Quick Share feature to prevent exploitation.
Settings > Connected devices > Connection preferences > Quick Share > Turn off
Restrict Network Access
allUse trusted networks only and avoid public/untrusted Wi-Fi.
🧯 If You Can't Patch
- Disable Quick Share feature entirely until patched.
- Use device only on trusted, secure networks.
🔍 How to Verify
Check if Vulnerable:
Check Quick Share Agent version in Settings > Apps > Quick Share > App info.Check Version:
Settings > Apps > Quick Share > App info > VersionVerify Fix Applied:
Confirm version is at or above patched versions: 3.5.14.47 (Android 12), 3.5.19.41 (Android 13), or 3.5.19.42 (Android 14).📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations via Quick Share
- Network connections to Quick Share from unexpected sources
Network Indicators:
- Unexpected network traffic to Quick Share service (typically port 1500)
SIEM Query:
Not typically applicable for mobile device monitoring; focus on endpoint detection.