PT-2014-2851 · Google · Android

Tamami Eguchi · Published 2014-03-03 · Updated 2014-03-10 · CVE-2013-4710

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 3.0 through 4.1.x

Description The issue is related to the improper implementation of the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page. This can be achieved by using the WebView.addJavascriptInterface method.

Recommendations For Android versions 3.0 through 4.1.x, consider disabling the WebView.addJavascriptInterface method as a temporary workaround until a patch is available. Restrict access to the WebView class to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-4710

Affected Products

Android

References · 14

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/browser/webview_addjavascriptinterface.rb · Exploit
• 🔥 https://exploit-db.com/exploits/41675 · Exploit
• 🔥 https://exploit-db.com/exploits/31519 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4710 · Security Note
• http://jvn.jp/en/jp/JVN53768697/995417/index.html · Note
• http://jvn.jp/en/jp/JVN53768697/113349/index.html · Note
• http://jvn.jp/en/jp/JVN53768697/index.html · Note
• http://jvn.jp/en/jp/JVN53768697/995293/index.html · Note
• http://jvn.jp/en/jp/JVN53768697/397327/index.html · Note
• http://jvn.jp/en/jp/JVN53768697/995312/index.html · Note
• http://emobile.jp/products/sh/a01sh/systemsoftware.html · Note
• http://jvndb.jvn.jp/jvndb/JVNDB-2013-000111 · Note
• http://openwall.com/lists/oss-security/2014/02/18/11 · Note
• http://50.56.33.56/blog/?p=314 · Note