Vulnerability Details : CVE-2012-6636
Public exploit exists!
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
Products affected by CVE-2012-6636
- cpe:2.3:a:google:android_api:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:15.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:14.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:13.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:12.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:10.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:11.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:android_api:2.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-6636
4.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2012-6636
-
Android Browser and WebView addJavascriptInterface Code Execution
Disclosure Date: 2012-12-21First seen: 2020-04-26exploit/android/browser/webview_addjavascriptinterfaceThis module exploits a privilege escalation issue in Android < 4.2's WebView component that arises when untrusted Javascript code is executed by a WebView that has one or more Interfaces added to it. The untrusted Javascript code can call into the Java Reflection
CVSS scores for CVE-2012-6636
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2012-6636
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-6636
-
http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1
Build.VERSION_CODES | Android Developers
-
http://50.56.33.56/blog/?p=314
dead && end
-
http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object,%20java.lang.String%29
WebView | Android Developers
-
http://jvn.jp/en/jp/JVN62161191/index.html
JVN#62161191: JavaFX WebEngine does not properly restrict Java method execution
-
https://support.lenovo.com/us/en/product_security/len_6421
SHAREit for Android Vulnerabilities - US
-
http://www.internetsociety.org/ndss2014/programme#session3
Programme announced for 2014 NDSS Security Symposium | Internet Society
-
http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf
Exploit
-
http://openwall.com/lists/oss-security/2014/02/07/9
oss-security - Re: CVE request: multiple issues in Apache Cordova/PhoneGap
Jump to