lazybear8372/cve-2023-31014_labEducational Android lab for CVE-2023-31014 implicit intent hijacking
An educational Android Lab created based on the public report of CVE-2023-31014 in NVIDIA GeForce NOW for Android. It does not include NVIDIA source code, actual Action strings, or real authentication credentials.
6.00.32705137 ~ 6.04.331088326.05.33200069The exposure categories publicly mentioned by Oversecured are stream configuration, user account, and game information.
| Category | Implementation |
|---|---|
| Game Launcher | victim/MainActivity |
| Normal Streamer | victim/StreamerActivity |
| Malicious Handler | attacker/HijackActivity |
| Information disclosure | Displays fictitious game, account, session, and stream configuration Extras |
| Denial of service | The attack Activity handles the Intent, so the normal Streamer does not start |
| Fix | Explicit Intent specifying the exact StreamerActivity |
The official materials do not disclose the actual component types. Therefore, this Lab uses an Activity → Activity model that is easy to learn. Since the actual chain leading to code execution was also not disclosed, code execution is not reproduced.
Victim Game Launcher
│
│ lab.cve202331014.action.START_STREAM
│ implicit Intent + virtual session extras
▼
Android Intent Resolver
├── Victim Normal Streamer
└── Attacker HijackActivity
The safe path applies the following restriction to the same Intent.
intent.setClass(this, StreamerActivity.class);
startActivity(intent);
Requirements:
./gradlew :victim:assembleDebug :attacker:assembleDebug
Generated APKs:
victim/build/outputs/apk/debug/victim-debug.apk
attacker/build/outputs/apk/debug/attacker-debug.apk
Verified prebuilt APKs are also included in dist/.
dist/cve-2023-31014-victim-debug.apk
dist/cve-2023-31014-attacker-debug.apk
Run only on an emulator or an authorized test device.
adb install -r attacker/build/outputs/apk/debug/attacker-debug.apk
adb install -r victim/build/outputs/apk/debug/victim-debug.apk
CVE Lab Attacker once to check the role of the attack app.CVE Lab Victim.Normal Streamer and CVE Lab Attacker.CVE Lab Attacker in the Android app chooser.Normal Streamer runs without the app chooser.If you specified an app to always use in the app chooser, perform Clear defaults in that app's system settings and then practice again.
Vulnerable:
Intent intent = new Intent(ACTION_START_STREAM);
intent.putExtra(EXTRA_STREAM_CONFIG, demoConfig);
startActivity(intent); // no package/component
Fixed:
Intent intent = new Intent(ACTION_START_STREAM);
intent.putExtra(EXTRA_STREAM_CONFIG, demoConfig);
intent.setClass(this, StreamerActivity.class);
startActivity(intent);
If the design requires Android to choose one of several components in the same vendor package, setPackage() can also be used to block external apps. For a single target, an explicit component is clearer.
The following values were intentionally created because they were not disclosed.
lab.cve202331014.action.START_STREAM Actiondemo_* Extra names and values203.0.113.10 documentation IP addressTherefore, this project reproduces the vulnerability principle and fix of the CVE, but it is not an actual GeForce NOW attack PoC.