Google’s Quick Share for Windows Vulnerability Let Attackers Remote Code

Critical vulnerabilities in Google’s Quick Share file transfer utility for Windows allowed attackers to achieve remote code execution (RCE) without user interaction. 

The flaws exposed millions of Windows users to potential attacks through this peer-to-peer data transfer application.

Ten unique vulnerabilities were observed in Quick Share for Windows, which researchers successfully chained together to create a sophisticated remote code execution attack. 

The most severe issue tracked as CVE-2024-38272, allowed attackers to bypass authentication controls and write files directly to a victim’s device without their approval or knowledge.

“We set out to inspect the specific application-layer communication protocol implemented by the Quick Share application to support file transfers between nearby, compatible devices,” explained Or Yair, Security Research Team Lead at SafeBreach. 

Through this investigation, the team was able to manipulate or bypass critical security logic within the application.

Google’s Quick Share for Windows Vulnerability

The attack chain involved multiple vulnerabilities, including:

• Remote Unauthorized File Write in Quick Share for Windows
• Remote Directory Traversal allows attackers to write files to arbitrary locations
• Remote Forced Wi-Fi Connection in Quick Share for Windows
• Multiple Remote Denial of Service (DoS) vulnerabilities that triggered unhandled exceptions

One of the DoS vulnerabilities could be triggered by code-creating file names containing invalid UTF8 continuation bytes. For example:

This would cause Quick Share to crash with an “Invalid UTF8 continuation byte” exception.

Following SafeBreach’s responsible disclosure in January 2024, Google issued CVE-2024-38271 and CVE-2024-38272, implementing fixes for all reported vulnerabilities. 

However, in a subsequent investigation, researchers discovered Google’s patches could be circumvented.

The most concerning bypass affected the critical CVE-2024-38272 vulnerability. Google’s fix attempted to mitigate the issue by deleting unauthorized files after they were written to disk, identifying them as “Unknown Files.” 

However, researchers found they could confuse this mechanism by sending two files in the same session with identical payload IDs.

“We saw that there was only one file added to the ‘UnknownFilePathsToDelete’ list in each session per a payload ID,” noted Yair. 

By exploiting this oversight, attackers could still write malicious files to a victim’s device that would not be automatically deleted.

Google’s Response

After discovering these bypass techniques, SafeBreach reported their findings to Google in August 2024. The company promptly addressed the issues and issued a new vulnerability identifier, CVE-2024-10668.

The implications extend beyond Quick Share itself. “We believe the implications are relevant to the software industry as a whole and suggest that even when code is complex, vendors should always address the real root cause of vulnerabilities that they fix,” stated Yair.

Users are strongly advised to ensure their Quick Share installations are updated to version 1.0.2002.2 or later, containing complete fixes for these vulnerabilities. 

The widespread nature of Quick Share, which may be pre-installed on many new Windows PCs, makes this update particularly urgent for maintaining system security.

This incident highlights the importance of thorough security testing for applications that bridge multiple platforms and communication protocols, especially when developed outside a company’s traditional expertise.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free