A now-patched security flaw has been disclosed in the Galaxy Store app for Samsung devices that could potentially trigger remote command execution on affected phones.
The vulnerability, which affects Galaxy Store version 220.127.116.11, relates to a cross-site scripting (XSS) bug that occurs when handling certain deep links. An independent security researcher has been credited with reporting the issue.
“Here, by not checking the deep link securely, when a user accesses a link from a website containing the deeplink, the attacker can execute JS code in the webview context of the Galaxy Store application,” SSD Secure Disclosure said in an advisory posted last week.
The issue identified in the Galaxy Store app has to do with how deep links are configured for Samsung’s Marketing & Content Service (MCS), potentially leading to a scenario where arbitrary code injected into the MCS website could lead to its execution.
This could then be leveraged to download and install malware-laced apps on the Samsung device when visiting the link.
“To be able to successfully exploit the victim’s server, it is necessary to have HTTPS and CORS bypass of chrome,” the researchers noted.