CVE-2013-6775 in SuperSU
Summary
by MITRE
The Chainfire SuperSU package before 1.69 for Android allows attackers to gain privileges via the (1) backtick or (2) $() type of shell metacharacters in the -c option to /system/xbin/su.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/09/2026
The Chainfire SuperSU package represents a critical privilege escalation vulnerability affecting Android devices with versions prior to 1.69. This vulnerability resides within the core privilege management mechanism of the superuser application, which is essential for granting root-level access to applications on rooted Android systems. The flaw specifically targets the command execution handling within the su binary, which serves as the primary interface for switching user contexts and executing commands with elevated privileges. The vulnerability stems from insufficient input sanitization when processing command-line arguments passed to the su binary through the -c option, creating a dangerous condition that allows attackers to inject malicious shell commands.
The technical exploitation of this vulnerability occurs through the manipulation of shell metacharacters, specifically backtick characters and $() command substitution syntax, which are fundamental components of Unix-like shell environments. When an attacker provides malicious input containing these metacharacters as part of the -c option parameter, the system fails to properly escape or validate the input before passing it to the underlying shell for execution. This creates a classic command injection vulnerability where attacker-controlled commands can be executed with the privileges of the target user, typically root. The vulnerability manifests because the su binary does not adequately sanitize shell metacharacters in the command string, allowing arbitrary code execution through legitimate privilege escalation pathways.
The operational impact of this vulnerability is severe and far-reaching for compromised Android devices. Attackers can leverage this privilege escalation to gain complete control over the device, potentially accessing sensitive user data, installing malicious applications, modifying system files, and establishing persistent backdoors. The vulnerability affects devices running Android versions where the SuperSU package was installed, making it particularly dangerous in environments where root access is commonly granted to third-party applications. The attack surface extends beyond simple command execution, as successful exploitation can lead to complete system compromise, data exfiltration, and the ability to bypass security controls that depend on proper privilege separation. This vulnerability directly violates the principle of least privilege and undermines the fundamental security model of Android systems.
Mitigation strategies for this vulnerability require immediate patching of the SuperSU package to version 1.69 or later, which includes proper input validation and sanitization mechanisms. Organizations and individuals should implement comprehensive device management policies that restrict the installation of untrusted applications that may attempt to exploit this vulnerability. The fix addresses the root cause by implementing proper shell metacharacter escaping and input validation before command execution, aligning with established security practices for preventing command injection attacks. Additionally, system administrators should conduct thorough vulnerability assessments to identify devices running vulnerable SuperSU versions and ensure that proper security controls are in place to detect and prevent unauthorized privilege escalation attempts. This vulnerability demonstrates the critical importance of proper input validation in security-critical components and aligns with CWE-78, which addresses improper neutralization of special elements used in shell commands, and represents a technique commonly associated with ATT&CK tactic TA0004 Privilege Escalation.
The vulnerability also highlights the broader security implications of third-party root management tools in mobile environments, where the trust model between applications and system components can be exploited to gain unauthorized access. Proper patch management and security monitoring become essential in preventing exploitation of such vulnerabilities, as the attack vector relies on the presence of vulnerable software components. The incident underscores the need for robust security practices in mobile device management and the importance of maintaining updated security controls to prevent exploitation of known vulnerabilities in privileged system components.