CVE-2025-9134
📋 TL;DR
This vulnerability allows improper export of Android application components in the AfterShip Package Tracker App, enabling local attackers to potentially access sensitive app data or functionality. It affects Android users running AfterShip Package Tracker App version 5.24.1 and earlier. The attack requires physical access to the device or malware already present on the device.
💻 Affected Systems
- AfterShip Package Tracker App
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with physical access could exploit this to access sensitive package tracking data, user information, or app functionality without proper authorization, potentially leading to data theft or unauthorized actions.
Likely Case
Malware already present on the device could leverage this vulnerability to escalate privileges or access AfterShip app data that should be protected, compromising user privacy.
If Mitigated
With proper Android security controls and user awareness, the impact is limited as it requires local access and cannot be exploited remotely.
🎯 Exploit Status
Exploit details are publicly disclosed on GitHub. Attack requires local access to the device. The vendor acknowledges the vulnerability exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 5.24.1
Vendor Advisory: Not provided in CVE details
Restart Required: No
Instructions:
1. Open Google Play Store 2. Search for 'AfterShip Package Tracker' 3. Check if update is available 4. Install the latest version 5. Verify app version is greater than 5.24.1
🔧 Temporary Workarounds
Disable app or restrict permissions
AndroidTemporarily disable the AfterShip app or restrict its permissions until patched
Go to Settings > Apps > AfterShip > Disable
Enable Android security features
AndroidEnsure device encryption, screen lock, and verify apps from unknown sources is disabled
Go to Settings > Security > Enable device encryption and screen lock
🧯 If You Can't Patch
- Remove the app from devices until patched version is available
- Implement mobile device management (MDM) policies to restrict app installation and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check app version in Settings > Apps > AfterShip > App info. If version is 5.24.1 or lower, you are vulnerable.Check Version:
adb shell dumpsys package com.aftership.AfterShip | grep versionNameVerify Fix Applied:
Update app via Play Store and confirm version is greater than 5.24.1 in app settings.📡 Detection & Monitoring
Log Indicators:
- Unusual access to AfterShip app components in Android logs
- Permission violations related to com.aftership.AfterShip
Network Indicators:
- Not applicable - this is a local vulnerability
SIEM Query:
Not applicable for local Android app vulnerabilities🔗 References
- https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md
- https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce
- https://vuldb.com/?ctiid.320514
- https://vuldb.com/?id.320514
- https://vuldb.com/?submit.615253
- https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md
- https://github.com/KMov-g/androidapps/blob/main/com.aftership.AfterShip.md#steps-to-reproduce
