CVE-2023-35671 - Android App Pin Security Issue Allowing Unauthorized Payments via Google Wallet

Описание: Android app pinning is a security feature that allows users to lock their device to a specific app, restricting access to other applications. When an app is pinned, the user is temporarily limited to using only that app, preventing unauthorized access to sensitive information or unintended actions. This feature is particularly useful in scenarios where privacy and security are paramount, such as when sharing a device with others or using public terminals. To exit the pinned app mode, users typically need to provide a predefined PIN, pattern, or biometric authentication, enhancing the overall security and control over the device's usage.

However, after unpinning an app, the payment cards registered in Google Wallet appear to be accessible to an external attacker despite the locked screen and despite the "Require device unlock for NFC" option being enabled.

An unauthenticated attacker who has physical access to the device can make payments with the victim's device or read the payment card details registered on Google Wallet (e.g., Card Account Number and expiry date).

To perform this attack, I used a Pixel 7 Pro and a Flipper Zero device.

I reported the bug to Google in February 2023, and Google released a corrective patch among the September 2023 Android updates. The CVE reserved for this vulnerability is CVE-2023-35671.

For further details please refer to my GitHub repository: https://github.com/MrTiz/CVE-2023-35671

https://nvd.nist.gov/vuln/detail/CVE-...
https://source.android.com/docs/secur...
https://source.android.com/docs/secur...
https://android.googlesource.com/plat...

P.S. Some blogs and online users claim that through this vulnerability it is not possible to make unauthorized payments. This is not true; in fact, if you use a real P.o.S., instead of a Flipper Zero-like device, Google Wallet makes a physical payment. Try it to believe.