PT-2023-24274

Name of the Vulnerable Software and Affected Versions KaiOS versions 3.0 through 3.1 Description An issue was discovered in the binary /system/kaios/api-daemon, which exposes a local web server on .localhost with subdomains for each installed application. For example, myapp.localhost. An attacker...

CVE-2023-33293: Exposure of Resource to Wrong Sphere

An issue was discovered in KaiOS 3.0 and 3.1. The binary /system/kaios/api-daemon exposes a local web server on .localhost with subdomains for each installed applications, e.g., myapp.localhost. An attacker can make fetch requests to api-deamon to determine if a given app is installed and read th...