What is Genero?
Genero is a product suite maintained by Four Js, designed to help developers build a wide range of services and applications using a single language and consistent layout syntax. It simplifies development by abstracting the technical details of the underlying systems, allowing both front-end and back-end applications to be deployed across various platforms with minimal adjustments.
Due to its broad capabilities, Genero includes many services and tools, several of which required patching when vulnerabilities were discovered.
Deeplinking to Remote Code Execution (RCE) — CVE-2022-29714
How the Vulnerability Was Found
During testing of an Android application developed with Genero, three things stood out:
- Files with unknown extensions in the /assets/app/ directory within the APK.
- The app's entry point related to a third-party component.
- Inability to intercept traffic from both Android and iOS versions.
These signs suggested non-standard behaviour, prompting deeper investigation. The AndroidManifest file revealed that the app exported a component named Startup, which could be triggered by explicit intents from other applications on the device.
This alone isn’t necessarily a problem, but further analysis found that the app did not adequately validate or sanitise input from those intents. As a result, a malicious app on the same device could exploit the exported component to trigger unintended behaviour.
How the Exploit Works
The vulnerable component, once triggered, passes data from the malicious intent into a service called ConnectivityService. This service then uses the intent data without proper validation, enabling an attacker to:
- Force the target app into debug or QA mode.
- Display arbitrary web content.
- Load and run arbitrary Genero applications.
The conditions required for successful exploitation included:
- A malicious app must be present on the same device.
- The target app must not already have the ConnectivityService running.
- The malicious intent data is repackaged but still improperly handled.
Proof of Concept
A proof of concept demonstrated that the attacker could drop a compiled Genero application onto the device's external storage and direct the vulnerable app to run it. The crafted payload, when executed, could display system information or interact with Android components — essentially allowing remote code execution (RCE) within the app's permissions.
For more information, refer to CVE-2022-29714 in the relevant security advisory.
Lack of Certificate Validation — CVE-2022-29715, CVE-2022-29716, CVE-2022-29717
Another critical issue was discovered in how Genero applications handled certificate validation. The implementation did not properly validate certificates against a trusted certificate store. This flaw made Genero applications vulnerable to Person-in-the-Middle (PitM) attacks, where a threat actor could intercept and tamper with traffic using an arbitrary certificate.
This affected:
- Android applications (CVE-2022-29716)
- iOS applications (CVE-2022-29715)
- The Genero Desktop Client, as confirmed by testing against a rogue SSH server (CVE-2022-29717)
