Android

MagiskEoP – Unpacking The Silent Root Exploit In Magisk

This is an exploit for a vulnerability in Magisk app that allows a local app to silently gain root access without user consent.

Vulnerability was initially reported by @vvb2060 and PoC-ed by @canyie. It has been fixed in Canary 27007.

Demo video for exploit this vulnerability to silently obtaining root privileges and granting root to any

Steps to reproduce this vulnerability:

  1. Install vulnerable Magisk app builds on a device that has no GMS preinstalled
  2. Install this exploit app
  3. Force stop Magisk app and this exploit app
  4. Open Magisk app
  5. Open this exploit app, type your commands and press Execute to execute them with root privileges

Vulnerability Info

Name: Magisk App Arbitrary Code Execution Vulnerability

Alias: Magisk Privilege Escalation Vulnerability

The Basics

Product: Magisk

CVE: N/A (not yet assigned)

Reporter: @vvb2060

Initial Report Date: 2024-08-01

Patch Date: 2024-08-21

Disclosure Date: 2024-08-24

Affected Versions: Manager v7.0.0 ~ Canary 27006

First Patched Versions: Canary 27007

Bug Class: Unsafe Dynamic External Code Loading

Weakness Enumerations:

Summary

Magisk is a suite of open source software for customizing Android. Prior to version canary 27007, in install of ProviderInstaller.java, there is a possible way to load arbitrary code into Magisk app due to a missing package validation.

This could lead to local escalation of privileges allowing attackers to gain root access with no additional privileges needed. User interaction is not needed for exploitation.

Details

Old Android versions do not support some algorithms. To make Magisk work properly on these platforms, it tries to load conscrypt from GMS by calling createCallingContext().

However, GMS is not always preinstalled on all devices. Magisk assumes that loading code from GMS is always safe, however attackers can create a fake malicious app with the same package name.

When Magisk app is launched, malicious code will get executed in Magisk app. Since Magisk app is always granted root access, this allows attackers to silently gain root access and execute arbitrary code with root privileges without user acceptance.

Vulnerable Devices

  • Devices with no GMS preinstalled
  • Devices with broken signature verification implementation (e.g. Disabled by CorePatch)

Note: This issue is fixed in Canary 27007 by ensuring GMS is a system app before loading it. However, it’s still possible to exploit this issue on devices with pre-installed GMS but have broken signature verification implementations (e.g. CorePatch).

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

3 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

3 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

3 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

3 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

3 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

3 weeks ago