Tinybeans Private Family Album App Arbitrary File Overwrite Vulnerability Allowing Code Execution

A vulnerability allowing arbitrary file overwrites has been identified in the Tinybeans Private Family Album App, version 5.9.5-prod. This vulnerability arises from inadequate security validation during the file import process, enabling attackers to overwrite critical internal files. Exploitation of this flaw could lead to arbitrary code execution, exposure of sensitive information, denial of service, and other serious security consequences.

Impact

Exploitation of this vulnerability could result in arbitrary code execution, unauthorized access to sensitive information, or causing the application to malfunction or crash.

Reproduction

The vulnerability can be reproduced by importing files through the application's file import process. A malicious app can be used to control the filename and content, employing path traversal techniques to overwrite sensitive files in the app's internal storage. Once the victim opens the malicious app, the overwrite occurs automatically, without requiring complex user interaction.