CVE-2024-7014 Overview
CVE-2024-7014, also known as "EvilVideo," is a critical vulnerability in Telegram for Android that allows attackers to send malicious applications disguised as video files. This deceptive attack vector exploits improper input validation in how Telegram handles media files, enabling threat actors to distribute malware through seemingly innocent video content shared in chats and channels.
Critical Impact
Attackers can distribute malicious Android applications (APKs) that appear as legitimate video files, potentially leading to device compromise, data theft, and unauthorized access when users attempt to play the disguised videos.
Affected Products
- Telegram for Android version 10.14.4
- Telegram for Android versions older than 10.14.4
Discovery Timeline
- 2024-07-23 - CVE-2024-7014 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-7014
Vulnerability Analysis
The EvilVideo vulnerability (CVE-2024-7014) stems from improper input validation (CWE-20) in Telegram for Android's media handling functionality. The vulnerability allows attackers to craft specially formatted payloads that masquerade as video files while actually containing malicious Android application packages (APKs).
When a user receives a message containing the malicious payload, Telegram's media preview system displays it as a normal video thumbnail, complete with a play button overlay. However, when the user attempts to play the "video," they are instead prompted to install an Android application. If the user has enabled installation from unknown sources or grants the necessary permissions, the malicious application is installed on their device.
The attack is particularly dangerous because it exploits user trust in media files shared through the Telegram platform. Videos are generally considered safe content, and users may not expect a video file to trigger an application installation prompt.
Root Cause
The root cause of CVE-2024-7014 is improper input validation in Telegram for Android's media file handling system. The application fails to properly verify the actual content type of files before rendering them in the user interface. This allows specially crafted files with manipulated headers and metadata to be displayed as video content while containing executable Android package data.
The vulnerability specifically affects how Telegram parses and presents media attachments, where the content-type identification relies on easily spoofable file attributes rather than rigorous content inspection.
Attack Vector
The attack leverages the network-based delivery mechanism through Telegram's messaging infrastructure. An attacker can exploit this vulnerability by:
- Crafting a malicious payload that combines video metadata with an Android APK
- Sending the disguised file through Telegram chats, groups, or channels
- When recipients view the message, they see what appears to be a video file
- Upon attempting to "play" the video, users are prompted to install an application
- If the user accepts the installation, the malicious APK is installed on their device
The attack requires some user interaction (attempting to play the video and accepting the installation prompt), but the deceptive nature of the disguised file significantly increases the likelihood of successful exploitation. For detailed technical analysis, see the ESET Research Analysis on EvilVideo Vulnerability.
Detection Methods for CVE-2024-7014
Indicators of Compromise
- Unexpected application installation prompts when attempting to play videos in Telegram
- Unknown or suspicious applications installed on device after viewing Telegram media
- Telegram messages containing "videos" that fail to preview properly or display unusual thumbnails
- APK files in Telegram's media cache directory that were not intentionally downloaded
Detection Strategies
- Monitor for unusual APK installations originating from Telegram's data directories
- Implement mobile threat defense solutions that scan Telegram media attachments
- Deploy endpoint detection and response (EDR) solutions capable of identifying disguised executables
- Configure security policies to alert on APK downloads from messaging applications
Monitoring Recommendations
- Enable logging for application installations on managed Android devices
- Monitor network traffic for unusual payload patterns in Telegram communications
- Implement user behavior analytics to detect abnormal application installation patterns
- Configure mobile device management (MDM) solutions to alert on unknown APK installations
How to Mitigate CVE-2024-7014
Immediate Actions Required
- Update Telegram for Android to the latest version (newer than 10.14.4)
- Disable "Install from Unknown Sources" permission for Telegram in Android settings
- Educate users about the EvilVideo vulnerability and the risks of playing videos from untrusted sources
- Review recently installed applications for any suspicious or unknown entries
- Implement mobile threat defense solutions across the organization's device fleet
Patch Information
Telegram has addressed this vulnerability in versions released after 10.14.4. Organizations and individual users should immediately update to the latest available version of Telegram for Android through the Google Play Store or official Telegram channels. The update includes improved validation of media file content types to prevent the disguised APK attack vector.
Workarounds
- Disable automatic media download in Telegram settings until the application is updated
- Configure Android devices to prevent installation from unknown sources system-wide
- Use mobile security solutions that scan incoming files before they can be executed
- Avoid opening videos from unknown or untrusted contacts until Telegram is updated
- Consider temporarily using Telegram Web or desktop clients as alternatives
# Android ADB command to check Telegram version
adb shell dumpsys package org.telegram.messenger | grep versionName
# Verify Telegram installation source
adb shell pm list packages -i | grep telegram
# Check for unknown sources permission (should be disabled)
adb shell settings get secure install_non_market_apps
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
