CVE-2023-29726

Vulnerability

The Call Blocker application version 6.6.3 for Android (package com.cuiet.blockCalls) exposes a key component — the content provider at URI content://com.cuiet.blockCalls.ContProvBlockCalls — without proper access restrictions. An attacker can use this component to insert arbitrarily large rows into the application's database (specifically the tbBlackList table). When the app subsequently starts, it loads the entire database into memory, and the excessive data triggers an OutOfMemoryError (OOM), causing a persistent crash and denial of service. The vulnerable app is distributed on Google Play [1][2].

Exploitation

An attacker requires only the ability to run an Android app on the same device (no special permissions or root access). The attack can be performed by a malicious local application that calls the exposed ContentResolver.insert() method on the vulnerable content provider. A proof-of-concept (PoC) [3] demonstrates a loop that repeatedly inserts rows with large random strings (5210 characters each) into the photo_uri and numeroContatto columns of tbBlackList. No user interaction with Call Blocker is needed during the injection phase; the denial of service occurs on the next launch of Call Blocker.

Impact

Successful exploitation results in a persistent denial of service. The Call Blocker application crashes each time the user attempts to start it, making the app permanently unusable unless the injected data is removed from the database. The user cannot block calls or use any of the app's features. This is a complete loss of availability for the targeted application. No data confidentiality or integrity is directly compromised.

Mitigation

No official fix or update has been released by the vendor (Fiorenza Francesco) as of the publication date. Users are advised to uninstall the vulnerable version (6.6.3) and monitor the Google Play listing for a patched version. As a manual workaround, a user with root or ADB access could delete or clear the application's database to restore functionality. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.