Security Researchers Discover Multiple Samsung Galaxy App Store Exploits, What You Need To Know

The key to any malware campaign is getting malicious code onto a target device, and often, attackers will use a legitimate app store as a vector. Samsung's Android smartphones ship with the Google Play Store, which has hosted its fair share of malware over the years, as well as the less popular Galaxy App Store. Security researchers from NCC Group have detected a pair of flaws in Samsung's app store that opened up devices to malware infection. The exploits have been patched, but outdated devices are still at risk.

Like the Play Store, Samsung's Galaxy App Store has privileged access to the system, allowing it to install and update apps without forcing the user to jump through hoops. Samsung distributes many of its own apps and services via this store, and there are third-party apps listed. The first exploit (CVE-2023-21433) leverages installation intents, which were not handled in a safe way. With physical access to the device, an attacker could tell a device to download an app from the store and open it with no security checks. NCC released a proof-of-concept consisting of an ADB (Android Debug Bridge) command.

The second vulnerability (CVE-2023-21434) goes a step further, allowing the attacker to run arbitrary JavaScript code on the device. Again, this happens because the Samsung app store has special access to the system. The proof-of-concept provided by NCC is simply a hyperlink that loads malicious JavaScript. As it turns out, the only security on webviews in the Galaxy App Store is a filter that looks for the "player.glb.samsung-gamelauncher.com" domain. However, an attacker can simply add that as a subdomain to any site, and the phone will happily run the code.

So, that's not great, but there's good news (and some bad news). NCC Group reported the issue to Samsung, and a new version of the Galaxy App Store (4.5.49.8) has been deployed this month to fix both flaws. In addition, new Google security measures in Android 13 will block these exploits. Unfortunately, only newer Samsung devices will ever see Android 13, so they could remain vulnerable at the system level, and devices that don't receive regular security updates may not have the updated app store client. If you use a Samsung phone, it's a good idea to ensure your system software and Galaxy App Store are completely updated. Even if you aren't due for a system update, opening the Galaxy App Store should offer the option to update the client alone.