CVE-2021-24027

HIGH

WhatsApp for Android <2.21.4.18 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-24027. PoCs published by CENSUS.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2021-24027, leveraging Man-in-the-Disk (MitD) and Man-in-the-Middle (MitM) techniques to exploit WhatsApp for Android. The exploit uses Frida to hook WhatsApp, send phishing messages, and exfiltrate session files via an HTTP server.

Description

A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material.

Exploits (1)

nomisec WORKING POC 147 stars
by CENSUS · poc
https://github.com/CENSUS/whatsapp-mitd-mitm

This repository contains a functional exploit PoC for CVE-2021-24027, leveraging Man-in-the-Disk (MitD) and Man-in-the-Middle (MitM) techniques to exploit WhatsApp for Android. The exploit uses Frida to hook WhatsApp, send phishing messages, and exfiltrate session files via an HTTP server.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Complex
Reliability
Reliable
Target: WhatsApp for Android (2.20.206.22)
No auth needed
Prerequisites: Android device with WhatsApp 2.20.206.22 · Frida server installed on the device · Root access for certain operations
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://www.whatsapp.com/security/advisories/2021/

Scores

CVSS v3 7.5
EPSS 0.0381
EPSS Percentile 88.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-524
Status published
Products (2)
whatsapp/whatsapp < 2.21.4.18
whatsapp/whatsapp_business < 2.21.4.18
Published Apr 06, 2021
Tracked Since Feb 18, 2026