CVE-2024-23700 - Android Companion Device Privilege Escalation PoC

This project demonstrates CVE-2024-23700, a privilege escalation vulnerability related to the Companion Device mechanism on Android. The PoC shows how an app can exploit the companion device association flow to obtain certain sensitive permissions without going through the normal runtime permission prompt in vulnerable environments.

The documentation and source code in this repository are provided for educational purposes, security analysis, and testing in authorized environments only. Do not use them on devices, accounts, or data that are not within the scope of legal testing.

Project Information

Course: Mobile Device Security

Team: This project was carried out by a team of 4 members.

During the research and completion of this project, the team carried out the following tasks:

• Researched the Companion Device Manager mechanism and the permission groups granted through the device profile.
• Analyzed the CVE-2024-23700 PoC and the conditions that make a device vulnerable.
• Rebuilt a sample Android app to simulate permission granting, read sensitive data, and record the results in a lab environment.
• Added a note-taking app UI, a Notification Listener, and the ability to send collected data to an internal test server to observe the captured data.

Overview

The project implements an Android app disguised as a simple note-taking application (My Notes). On launch, the app calls CompanionDeviceManager.associate() with a companion device profile to simulate the permission takeover process through CVE-2024-23700. If the device or ROM meets the vulnerable conditions, the app can obtain additional sensitive permissions and access data such as contacts, SMS, call logs, calendar, notifications, and some device information.

Main operation flow of the PoC:

1. Launch the note-taking app: Displays an interface for entering and saving notes to conceal the test behavior.
2. Call Companion Device Manager: Creates a companion device association request using the watch profile.
3. Handle the association activity: The CompanionAssociationActivity component simulates the response approving the device association.
4. Check permissions and collect data: If permissions are granted, the app reads test data from the corresponding content providers.
5. Record results: The data is packaged as JSON and sent to the lab endpoint for analysis.

CVE Information

CVE ID: CVE-2024-23700
Android severity: Critical
Affected component: Android Companion Device Manager
Reference patch: Android Wear Security Bulletin 2024-05-01
Reference fix commit: AOSP frameworks/base patch

According to the original PoC README, most standard Android devices are not affected, except in cases such as:

• WearOS devices with a security patch level before 2024-05-01.
• ROMs that have removed or broken the com.android.companiondevicemanager component.
• Devices whose signature verification mechanism has been disabled or altered by a third-party module.

If the PoC APK cannot be installed on the device, that may be a sign that the device does not meet the vulnerable conditions for this vulnerability.

Directory Structure

CVE-2024-23700/
├── app/
│   ├── build.gradle - Cấu hình module Android application
│   ├── proguard-rules.pro - Quy tắc ProGuard cho module app
│   └── src/main/
│       ├── AndroidManifest.xml - Khai báo quyền, activity và notification listener
│       ├── java/
│       │   ├── com/android/companiondevicemanager/
│       │   │   └── CompanionAssociationActivity.java - Activity xử lý luồng association
│       │   └── com/vsoft/mynotes/
│       │       ├── MainActivity.java - Logic chính của ứng dụng PoC
│       │       └── NotificationListener.java - Dịch vụ lắng nghe thông báo
│       └── res/
│           ├── drawable/ - Tài nguyên drawable của ứng dụng
│           ├── drawable-v24/ - Tài nguyên drawable cho API 24+
│           ├── layout/main.xml - Giao diện ứng dụng ghi chú
│           ├── mipmap-*/ - Icon ứng dụng theo từng mật độ màn hình
│           └── values/ - Chuỗi và theme ứng dụng
├── gradle/wrapper/ - Gradle wrapper jar và cấu hình wrapper
├── .gitignore - Quy tắc loại trừ file local, build output, log và script phụ trợ
├── build.gradle - Cấu hình Gradle cấp project
├── gradle.properties - Thiết lập Gradle của project
├── gradlew - Script chạy Gradle trên Linux/macOS
├── gradlew.bat - Script chạy Gradle trên Windows
├── settings.gradle - Khai báo project và module
└── README.md

Main Components

Permission Groups Tested

The app manifest declares multiple permission groups to verify the impact of the vulnerability in a vulnerable environment:

• Companion profile: REQUEST_COMPANION_PROFILE_WATCH, REQUEST_COMPANION_PROFILE_GLASSES
• Background restriction: REQUEST_COMPANION_RUN_IN_BACKGROUND, REQUEST_COMPANION_USE_DATA_IN_BACKGROUND
• Contacts: READ_CONTACTS, WRITE_CONTACTS, GET_ACCOUNTS
• SMS: READ_SMS, SEND_SMS, RECEIVE_SMS, RECEIVE_MMS, RECEIVE_WAP_PUSH
• Calls: READ_PHONE_STATE, , , ,

Observed Data Format

Data sent to the lab server is packaged in JSON format. The main data groups include:

• device_info: device information, Android version, device name, Android ID, IP, installed apps, accounts, SIM, Wi-Fi, battery, RAM, and free storage.
• c_cache: contact data read in the test environment.
• l_cache: call logs.
• s_cache: SMS.
• cal_cache: calendar events.
• gps_cache: the most recent location if the user grants location permission.
• n_cache: existing notifications or new notifications captured by NotificationListener.
• n_active: operational status of the notification listener.

Notes

• Run the PoC only on devices, accounts, and data that are authorized for testing.
• Use fake data or a dedicated lab device to avoid leaking personal information.
• The data-receiving endpoint in MainActivity.java should be replaced with an internal endpoint controlled by the tester.
• Do not publicly distribute a prebuilt APK unless the endpoint, logs, and sensitive test data have been removed.
• On patched devices, the association flow or APK installation may fail; this is expected behavior.