CVE-2024-2045: 
Homebrew vulnerability analysis and mitigation

CVE-2024-2045 is a vulnerability discovered in Session version 1.17.5, a private messenger for Android. The vulnerability was discovered on February 21, 2024, and publicly disclosed on February 29, 2024. The vulnerability allows unauthorized access to internal application files and public files from the user's device without proper consent (Fluid Attacks).

The vulnerability is classified as a Local File Read (LFR) vulnerability that can be exploited through chat attachments. It has been assigned a CVSSv3.1 Base Score of 4.4 with the vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N. The exploit requires local access and user interaction to be successful (Fluid Attacks).

When exploited, the vulnerability allows attackers to obtain internal application files and access files from public paths accessed by the application, such as images and downloads. This could lead to unauthorized access to sensitive information stored within the application (Fluid Attacks).

The vulnerability requires a malicious application to be installed on the victim's device and some level of social engineering to convince the user to leak internal files to a specific contact. While automatic sending to any Session user was not confirmed possible, the researchers did not rule out this possibility (Fluid Attacks).

As of the vulnerability disclosure, there is no official patch available for this vulnerability (Fluid Attacks).