This is an exploit for a vulnerability in Magisk app that allows a local app to silently gain root access without user consent.
Vulnerability was initially reported by @vvb2060 and PoC-ed by @canyie. It has been fixed in Canary 27007.
Demo video for exploit this vulnerability to silently obtaining root privileges and granting root to any
Steps to reproduce this vulnerability:
Name: Magisk App Arbitrary Code Execution Vulnerability
Alias: Magisk Privilege Escalation Vulnerability
Product: Magisk
CVE: N/A (not yet assigned)
Reporter: @vvb2060
Initial Report Date: 2024-08-01
Patch Date: 2024-08-21
Disclosure Date: 2024-08-24
Affected Versions: Manager v7.0.0 ~ Canary 27006
First Patched Versions: Canary 27007
Bug Class: Unsafe Dynamic External Code Loading
Weakness Enumerations:
Magisk is a suite of open source software for customizing Android. Prior to version canary 27007, in install of ProviderInstaller.java, there is a possible way to load arbitrary code into Magisk app due to a missing package validation.
This could lead to local escalation of privileges allowing attackers to gain root access with no additional privileges needed. User interaction is not needed for exploitation.
Old Android versions do not support some algorithms. To make Magisk work properly on these platforms, it tries to load conscrypt from GMS by calling createCallingContext().
However, GMS is not always preinstalled on all devices. Magisk assumes that loading code from GMS is always safe, however attackers can create a fake malicious app with the same package name.
When Magisk app is launched, malicious code will get executed in Magisk app. Since Magisk app is always granted root access, this allows attackers to silently gain root access and execute arbitrary code with root privileges without user acceptance.
Note: This issue is fixed in Canary 27007 by ensuring GMS is a system app before loading it. However, it’s still possible to exploit this issue on devices with pre-installed GMS but have broken signature verification implementations (e.g. CorePatch).
This Python script for Linux can analyze Microsoft Windows *.msi Installer files and point out…
Bear C2 is a compilation of C2 scripts, payloads, and stagers used in simulated attacks…
Discover your application security risks and vulnerabilities in only a few minutes. In this guide…
The idea behind waymore is to find even more links from the Wayback Machine than…
The Pycript extension for Burp Suite is a valuable tool for penetration testing and security…
For official releases, refer to Dependency Track Docs >> Changelogs for information about improvements and…