CVE-2024-38271
Last modified
CVE-2024-38271 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiFi network and then sends an OfflineFrame that crashes Quick Share. This makes the Wifi connection to the attacker’s network last, instead of returning to the old network when the Quick Share session completes, allowing the attacker to be a MiTM. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiFi network and then sends an OfflineFrame that crashes Quick Share. This makes the Wifi connection to the attacker’s network last, instead of returning to the old network when the Quick Share session completes, allowing the attacker to be a MiTM. We recommend upgrading to version 1.0.1724.0 of Quick Share or above
Metrics
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Nearby | < 1.0.1724.0 |
References
- https://github.com/google/nearby/pull/2402Issue Tracking, Patch
- https://github.com/google/nearby/pull/2433Issue Tracking, Patch
- https://github.com/google/nearby/pull/2435Issue Tracking, Patch
- https://github.com/google/nearby/pull/2589Issue Tracking, Patch
- https://github.com/google/nearby/pull/2402Issue Tracking, Patch
- https://github.com/google/nearby/pull/2433Issue Tracking, Patch
- https://github.com/google/nearby/pull/2435Issue Tracking, Patch
- https://github.com/google/nearby/pull/2589Issue Tracking, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-38271?
How severe is CVE-2024-38271?
How do I fix CVE-2024-38271?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-38266An improper restriction of operations within the bounds of a…4.9
- CVE-2024-38267An improper restriction of operations within the bounds of a…4.9
- CVE-2024-38268An improper restriction of operations within the bounds of a…4.9
- CVE-2024-38269An improper restriction of operations within the bounds of a…4.9
- CVE-2024-3827The Spectra Pro plugin for WordPress is vulnerable to Stored…5.4
- CVE-2024-38270An insufficient entropy vulnerability caused by the improper…6.5
- CVE-2024-38272There exists a vulnerability in Quick Share/Nearby, where an…4.3
- CVE-2024-38273Insufficient capability checks meant it was possible for use…5.4
- CVE-2024-38274Insufficient escaping of calendar event titles resulted in a…6.1
- CVE-2024-38275The cURL wrapper in Moodle retained the original request hea…7.5
- CVE-2024-38276Incorrect CSRF token checks resulted in multiple CSRF risks.8.8
- CVE-2024-38277A unique key should be generated for a user's QR login key a…5.4
Are you affected by CVE-2024-38271?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST