CVE-2014-8609 PoC — Android Settings应用程序权限许可和访问控制漏洞

Source

https://github.com/ratiros01/CVE-2014-8609-exploit

Associated Vulnerability

Title:Android Settings应用程序权限许可和访问控制漏洞 (CVE-2014-8609)
Description:The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.

Readme

# CVE-2014-8609-exploit
During the study of pending intent exploitation, I created my PoC application of CVE-2014-8609

Reference: 
1. https://seclists.org/fulldisclosure/2014/Nov/81
2. https://github.com/locisvv/Vulnerable-CVE-2014-8609

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →