[Suggested description] An issue was discovered in SeTracker2 for TK-Star Q90 Junior GPS horloge 3.1042.9.8656 devices. It has unnecessary permissions such as READ_EXTERNAL_STORAGE, WRITE_EXTERNAL_STORAGE, and READ_CONTACTS. ------------------------------------------ [Additional Information] The manifest of Q90 declares the use of permissions. However some of the declared functions are not required for proper functioning of the application. The following application permissions are not required: android.permission.SYSTEM_ALERT_WINDOW: Allows an app to create windows using the type WindowManager.LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.WRITE_EXTERNAL_STORAGE: Declaring these permissions for debugging purposes is common practice, but they should not be carried over to production releases of the app. android.permission.READ_EXTERNAL_STORAGE. android.permission.CHANGE_WIFI_STATE: Allows applications to change Wi-Fi connectivity state. android.permission.CHANGE_CONFIGURATION: Allows access to the list of accounts (including usernames) in the Accounts Service. android.permission.READ_CONTACTS: Allows an application to read the user's contacts data. android.permission.MANAGE_ACCOUNTS: The application can request create or access accounts stored locally in the AccountManager. android.permission.GET_ACCOUNTS: Allows access to the list of accounts (including usernames) in the Accounts Service. android.permission.BLUETOOTH: Allows applications to connect to paired bluetooth devices. android.permission.BLUETOOTH_ADMIN: Allows applications to discover and pair bluetooth devices. android.permission.GET_TASKS: Allows the app to retrieve information about currently and recently running tasks. This may allow the app to discover information about which applications are used on the device. The backup element (android:allowBackup) is manually set to true. The sheer amount of unnecessary permissions, with potential high security impact, (e.g. reading all contact information, retrieving usernames, passwords and other personal information stored on the device, changing system settings, connecting to other devices) provides the application with an unnecessarily large amount of sensitive information and (potential) control over older (API 16-22) mobile devices and raises numerous questions regarding the intentions behind this application. ------------------------------------------ [Vulnerability Type] Insecure Permissions ------------------------------------------ [Vendor of Product] TK-star ------------------------------------------ [Affected Product Code Base] TK-Star Q90 Junior GPS horloge - 3.1042.9.8656 ------------------------------------------ [Affected Component] Q90 SeTracker2 ------------------------------------------ [Attack Type] Local ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [CVE Impact Other] Excessive permissions can enable malicious behaviour. ------------------------------------------ [Attack Vectors] to exploit the vulnerability, the application code must be updated with malicious intent. ------------------------------------------ [Has vendor confirmed or acknowledged the vulnerability?] true ------------------------------------------ [Discoverer] Dennis van Warmerdam, Jasper Nota, Jim Blankendaal ------------------------------------------ [Reference] https://www.tk-star.com Use CVE-2019-20468.