PT-2014-2405 · Google · Android

Published 2014-03-03 · Updated 2020-07-28 · CVE-2012-6636

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android API versions prior to 17

Description The issue allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier.

Recommendations For Android API versions prior to 17, consider restricting the use of the WebView.addJavascriptInterface method until a patch is available. As a temporary workaround, avoid using the WebView component to load crafted JavaScript code.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-6636

Affected Products

Android

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/browser/webview_addjavascriptinterface.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41675 · Exploit
• 🔥 http://cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf · Exploit
• https://cve.org/CVERecord?id=CVE-2012-6636 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-6636 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-6636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-6636 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/02/07/9 · Note
• http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt · Note
• http://jvn.jp/en/jp/JVN62161191/index.html · Note
• http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1 · Note
• http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29 · Note
• http://openwall.com/lists/oss-security/2014/02/07 · Note
• https://t.me/cvenotify/904 · Telegram Post
• https://support.lenovo.com/us/en/product_security/len_6421 · Note