CVE-2023-29727

Vulnerability

The Call Blocker application (com.cuiet.blockCalls) version 6.6.3 for Android exposes a content provider component (ContProvBlockCalls) without proper permission enforcement. The provider's delete method is accessible to any third-party application on the device, allowing arbitrary deletion of records in the tbBlackList table of the app's internal database. This database stores user-defined blacklist numbers and privacy preferences. The attack does not require any special privileges beyond the ability to invoke a content resolver operation on the device. [1] [3]

Exploitation

An attacker needs to install any unprivileged malicious application on the same Android device. The malicious app can then use the Android ContentResolver.delete() method targeting the URI content://com.cuiet.blockCalls.ContProvBlockCalls/tbBlackList. The proof-of-concept code shown in reference [3] demonstrates an infinite loop that deletes all rows in the blacklist table by passing a whereClause and whereArgs that match any row. No user interaction or specific permissions beyond normal ContentResolver access are required. [3]

Impact

Successful exploitation allows the attacker to delete the victim's entire call-blocking blacklist and associated privacy settings. This breaks the core functionality of the app—unwanted calls will no longer be blocked—and can expose the user to spam, robocalls, and known malicious numbers that were previously blocked. The app's privacy controls are effectively bypassed, leading to an escalation of privilege for the attacker (gaining unauthorized data deletion capability). The confidentiality and integrity of the user's call-blocking rules are lost. [1] [3]

Mitigation

As of the publication date (2023-05-30), no official patch has been released by the vendor. The affected version is 6.6.3, and the app is available on Google Play. Users should monitor the vendor's site (call-blocker.info) [1] for updates or consider removing the app until a fix is issued. There is no known workaround besides uninstalling or restricting the app's permissions via ADB (though this does not prevent exploitation from other installed apps). This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. [1] [3]