CVE-2023-35683

What it actually does

The flaw is a SQL injection in bindSelection of DatabaseUtils.java that permits construction of queries capable of reading files outside the calling application's sandbox, resulting in local information disclosure.

Why it matters to the business

Allows one application on an Android device to silently access data belonging to other applications, increasing risk of privacy violations and potential exposure of sensitive user information across the device ecosystem.

How an attack unfolds

An attacker with the ability to execute code on the device supplies a malicious selection argument to the vulnerable bindSelection method; the resulting SQL injection bypasses normal path and permission checks, returning file contents from other applications without user interaction or elevated privileges.

How to fix it

Apply the security update that corrects the SQL injection in DatabaseUtils.java; upgrade affected Android devices to the patched release once available from the device manufacturer.

How to confirm the fix worked

Inspect source or binary usage of bindSelection for untrusted input, then attempt controlled injection payloads in a test environment to verify whether file paths outside the sandbox can be accessed.

Typical attack path

1. Gain ability to execute code within a local application context
2. Identify call sites that invoke DatabaseUtils.bindSelection with attacker-controlled input
3. Craft a selection string containing SQL syntax to escape intended query boundaries and reference external files
4. Trigger the query and retrieve file contents from other applications

How to detect it

Review Android application and system logs for unexpected database query patterns or file-access attempts that reference paths outside an application's own data directory; correlate with process execution originating from untrusted packages.

What your security team should do

• Expedite deployment of Android security patches to all managed devices
• Audit internal and third-party applications for direct or indirect use of the affected database utility methods
• Implement runtime monitoring for anomalous cross-application file reads on Android endpoints