Amazon fixes a critical vulnerability on its Amazon Photos Android app

Cybersecurity researchers at leading software security company Checkmarx have discovered a critical vulnerability in the Amazon Photos app on Android, which can allow a malicious application to be installed on the user’s phone and steal the Amazon access token.

Technically, the Amazon access token is used to authenticate users across different application program interfaces (API), some of which contain personally identifiable information (PII) that might be revealed during attacks. Threat actors (TA) may obtain complete access to a user’s files using other APIs, such as the Amazon Drive API.

Checkmarx claimed that the flaw resulted from an incorrect configuration of one of the Photos app’s parts, making it accessible to outside programs. Each time this activity was started, an HTTP request was sent with a header containing the user’s access token. The request’s recipient server could then be managed.

Knowing this, the researchers created a malicious application that could send an intent from the victim’s phone, effectively starting the vulnerable activity and causing a request to be sent to an attacker-controlled server. With so many options available to an attacker, it was simple to think of ransomware as a likely attack vector. The customer’s files would only need to be read, encrypted, and rewritten once, and the customer’s history would need to be erased.

Checkmarx went on to say that it only examined a small subset of the entire Amazon ecosystem—a few APIs—in its research. The security experts explained that an attacker might have access to additional Amazon APIs using the same token.

Checkmarx claimed that after learning of these flaws, it immediately contacted the Amazon Photos development team. Amazon regarded this as a high severity issue and promptly released a fix for it due to the vulnerability’s high potential impact and high likelihood of success in actual attack scenarios.