Zora: Post, Trade, Earn Crypto Arbitrary File Overwrite Vulnerability Allowing Code Execution

An arbitrary file overwrite vulnerability has been identified in the Zora: Post, Trade, Earn Crypto app, version 2.60.0. This vulnerability allows attackers to overwrite critical internal files through the file import process, potentially leading to arbitrary code execution or exposure of sensitive information. The issue arises from inadequate security validation when handling imported files, enabling a malicious app to manipulate filenames and contents to overwrite important files in the app's internal storage. Such modifications can cause the app to malfunction, fail to launch, or execute unauthorized code. The vulnerability can be exploited automatically once the victim opens the malicious app, without requiring complex user interaction.

Impact

Exploitation of this vulnerability can result in arbitrary code execution or unauthorized modification of internal files, potentially leading to privilege escalation or causing the app to malfunction.

Reproduction

To reproduce this vulnerability, a malicious app must be created that exploits the file import process by using path traversal techniques to overwrite critical files in the Zora app's internal storage. Once the malicious app is installed, it can automatically trigger the overwrite without user intervention.