{"id":"CVE-2024-10668","summary":"Auth Bypass in Quickshare","details":"There exists an auth bypass in Google Quickshare where an attacker can upload an unknown file type to a victim. The root cause of the vulnerability lies in the fact that when a Payload Transfer frame of type FILE is sent to Quick Share, the file that is contained in this frame is written to disk in the Downloads folder. Quickshare normally deletes unkown files, however an attacker can send two Payload transfer frames of type FILE and the same payload ID. The deletion logic will only delete the first file and not the second. We recommend upgrading past commit 5d8b9156e0c339d82d3dab0849187e8819ad92c0 or Quick Share Windows v1.0.2002.2","modified":"2026-10-08T07:05:42.036856272Z","published":"2024-11-07T15:22:24.280Z","database_specific":{"cwe_ids":["CWE-434"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10668.json","unresolved_ranges":[{"extracted_events":[{"fixed":"1.0.2002.2"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"Google"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10668.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10668"},{"type":"FIX","url":"https://github.com/google/nearby/pull/2892"},{"type":"PACKAGE","url":"https://github.com/google/nearby"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/google/nearby","events":[{"introduced":"0"},{"fixed":"5d8b9156e0c339d82d3dab0849187e8819ad92c0"}]}],"versions":["v0.0.1-ios"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10668.json","vanir_signatures":[{"deprecated":false,"digest":{"length":1540,"function_hash":"49291409367868850145480854819013661082"},"id":"CVE-2024-10668-1e331d4d","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/nearby_connections_manager_impl.cc","function":"NearbyConnectionsManagerImpl::OnPayloadTransferUpdate"}},{"digest":{"line_hashes":["283536230209410083967938461702055134783","75789771637364630815353230255941074941","124024032772744777976100373007198736812","208924514373744560057636193394930172263","339186667667952566932875896786507318581","284638282293945216122928189712950969911","167755423994540835273730431735150272866","161761331267659312726226238261632075745","98684566494057555405788580003286280238","11198442305995099792161376846317326581","132049876832673117147012407540118965847","301811076866494667296770696802058688467","250499488968340566757402245449439994146","227706146167217854721703854025400683274","298772218553139351467953929192505547461","163908777443362931619186319976478963426","11198442305995099792161376846317326581","132049876832673117147012407540118965847","301811076866494667296770696802058688467","250499488968340566757402245449439994146","62312852922202130723948548322340262079","25956382535963795050939914516846334925","88764174422258341189223732569245372077","95928312400788228976632494427256546010","52654911607414598735791097487206181954","123921293434067249078257972039612228736"],"threshold":0.9},"id":"CVE-2024-10668-2438b45d","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/nearby_connections_manager_impl_test.cc"},"deprecated":false},{"id":"CVE-2024-10668-260eaed0","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/flags/generated/nearby_sharing_feature_flags.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["160430962707807260642657728841736938159","273757901641955649768999092944405592234","269777797387920701926692234078740340828","15114492964241157853191278840441184125","262468007333073733107018318635171804280","180801978443203963985929884635866698277","144513219630781310651405799064143435945","197560383528484335926019117922618743940"]}},{"signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/nearby_connections_manager_impl.h"},"deprecated":false,"digest":{"line_hashes":["15444804761919420018931631571432884754","176084744494315075904076456519947207545","215750372688937427437774361029545153908","283659024778636930184399172190188499053","103670824267119683372026999327225125072","324656506936264699612455333879377477611","22323805313813519604936642211429377819","171033018742612387007677443360170898180"],"threshold":0.9},"id":"CVE-2024-10668-3747f7af","signature_type":"Line"},{"source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/flags/generated/nearby_sharing_feature_flags.h","function":"GetBoolFlags"},"deprecated":false,"digest":{"function_hash":"155724079534136410010553190726944535356","length":627},"id":"CVE-2024-10668-4bd5f95b","signature_type":"Function","signature_version":"v1"},{"digest":{"length":1102,"function_hash":"97927518270249582423707185784533115049"},"id":"CVE-2024-10668-adbd9f33","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"function":"TEST_F","file":"sharing/nearby_connections_manager_impl_test.cc"},"deprecated":false},{"id":"CVE-2024-10668-c3765870","signature_type":"Function","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/nearby_connections_manager_impl_test.cc","function":"TEST_F"},"deprecated":false,"digest":{"function_hash":"9435966158206504575610332725515202001","length":1046}},{"signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"function":"NearbyConnectionsManagerImpl::OnEndpointFound","file":"sharing/nearby_connections_manager_impl.cc"},"deprecated":false,"digest":{"length":846,"function_hash":"325765130213925009085995367486170158725"},"id":"CVE-2024-10668-cb0e9bb0","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"function":"NearbyConnectionsManagerImpl::OnPayloadReceived","file":"sharing/nearby_connections_manager_impl.cc"},"deprecated":false,"digest":{"length":307,"function_hash":"135490758780773059639770855422441782405"},"id":"CVE-2024-10668-ddebdac4"},{"deprecated":false,"digest":{"line_hashes":["227873317588112154223260846478635706791","107473115569515465003099163037114034022","223633936179957428033715882367382499773","182007727519003748185717447727956890996","60031104687825860618807369580407301996","243336605907646437423741183811119362319","109559221110426876976840535226023120187","326640618624270966236640939361373750178","321491787928157427418603147816971262607","152230032470785072796063183873127292419","206182766609268469544972282979789283385","207251033210485227834939090035272812842","103750569534501590866656357713642523048","281587302061963748313077717916581128342","263280066068759756331144809987594788919","23305018402286075853772721503404179802","155538603221906188984226504827570497267","16058468592396054170815159919168866234","17014126218098012449651213248981836158","266549079252528617848986647984866708134","175485465201907809558838819081558838000","64885771798218446367350852030499213692","119505098739074931159184320118027540699","207309435260881110724495962006048702720","291617581087682765873474107728183285621","4383397308328951691102387483435365675","106466002571508970987945596542792677745","161624976545566988693793408087220206706","36836707330946823699187133078055170272","291275657112648483995326470848548061002","98472196350447135448163001366285704623","15718898241592038512017653408800417419","265344857810831165749200462332626942355","293738120722134689155739434757230991964","264978841069685307472084366667748984047","233211210975837151677333963073999971809","269189293970639415418030340239516771362","77177790749306126707982218236102454341","96024959871433276847261173872487934674","339193332463092280978278477310793693035","60379627929313822922547505225659952538","225045032956242127611886902789432614192","188175841670943376268755830959540604478","253421534557797816270543137381390957554","164527394177461511379542618921570072634","157387720284065718199933790258688167906","110691603366961764105713376018869609742","320328241156713062168046065361108666074","126868485639139145407966302523367635828","178584981209367856150432554679931819475","274659139670558603647664762284868040606","43033928642632985363999036857697302284","110364946460497937517669740697088132116","210979225763292303145056173101530215671","113625012065400303988096310597921061995","138556792068388791486375863693713497418","169244834766655423662768146141216615671","225545789173460615320950736570090371860","89011583091294178164638875222153522802","136468125024171618597410984836223000188","324731413398133634731429229160280704492","333517288348224470217699695105207105188","108573351328004854351667735327238945581","141745254324397768116932965595980210359","91010061524037639539228461531319266673","254846921767456044940306902528626218902","332198594095100318440364805689480776507","237233438789025907713218307117450338078","254516103148922130473728400847108460122","76418919068119789421480181987485189394","174179284832745209614012714644266992859","274049409609907280986704009836307099340","248184698086841424903443007848049097668","215971624241369379730357727046987693063","316573718102882554995066455155894976780","78899285369901810318502706051619894523","62653129659518459918628311413663488165","225730837139578031365166830929239274285","191314993386173418987592550443122409292","16324070594759480492156457498946825991","279539310525515562912539604720758900533","52494366525252715153935259584662951308","109384365852078971786584585390919354535","229638808165010391409009358350275048151","26080909981022718575640226027084126778","10276419870129257805254011465823542186","58666261684933792799731736630673939496","319689275474912195971707858368544162080","97506773177618401509837949900271683582","246935487763403113626232725607821064266","116362070788521549837155200685719761623","25350576670223999142498791552467451022","164008340979980169007691877075111674426","325260617031664865142547730903656445955","112762318065248640963506046088219605694","295939661160326877967134996665254894","153435677274866793165446734465513044471","170469807482965492716938209314932078102","46296506856052530177202416159326068689","161690287261100679136157319954750519923","165237043903137572571186597033510338844","304155729008382933628976398377522018191","134690723473447954641290405012078814124","202727545044083328252783897340279238798","283839833291619000769751034243590905498","81577911164310508922777168304054574240","58400454643586252229065060631522085078","222408740671907814859938475798320496286","34476132585018781098896135201860365856","289339890445087027952238783702167049833","226761064138258484178000940999608188690","275519504721606401195829965951100392648","103512404739701103357394168415565143300","61952313570514783857774357242349205364","230976268496389594408831755572013886763","253918652360767333612057273757813855746","257962041867008559510464548924489802190","6319287361979254538127936116707001000","122015533943578103885522859638585534138","62670570486611021429531535104436026752","22533679404539993265384794455567425099","202206233443551337475591463371871580978","250069037122149835417356882880858927349","10932002842908847100786829505058778049","261518447780928470773268168699807029771","71422621266382134596425451428556048289","79258553405735279317566669991707000137","26206832267339343007339593542412061422","328184240522386946907854760640247106531","314906817076835288949863039345835302084","37465305392804405799892322724647551667","94534443402607665752529789035018888999","169400804140264044472064575908743027280","296250221256643005022137458474851227990","249791182159470002157849480096989949616","268841807341934729576878830105404786626"],"threshold":0.9},"id":"CVE-2024-10668-e783ee5e","signature_type":"Line","signature_version":"v1","source":"https://github.com/google/nearby/commit/5d8b9156e0c339d82d3dab0849187e8819ad92c0","target":{"file":"sharing/nearby_connections_manager_impl.cc"}}],"vanir_signatures_modified":"2026-10-08T07:05:42Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:N/R:U/V:D/RE:L/U:Green"}]}