| 제목 | LeeDrOiD Labs Shortcutter - Quick Settings & Shortcuts (com.leedroid.shortcutter) 7.8.0 (780) Privilege Escalation |
|---|
| 설명 | Shortcutter 7.8.0 contains an improper caller-authorization vulnerability in the exported activity com.leedroid.shortcutter.activities.ToggleGeneric.
ToggleGeneric is exported without a caller permission and accepts an attacker-controlled Intent extra named "Class". The supplied value is passed to Class.forName(), after which a public doToggle(Context) method is resolved through reflection and invoked under the Shortcutter process and UID.
No calling UID, calling package, signature permission, shortcut-origin validation, or equivalent authorization check is performed before the selected helper executes.
A co-installed malicious application can therefore invoke internal Shortcutter helpers and cause privileged actions to be performed using Shortcutter's previously granted permissions and trusted services.
This was dynamically reproduced with a proof-of-concept Android application that requests no Android permissions.
On the tested device, Shortcutter had android.permission.WRITE_SECURE_SETTINGS granted, its AccessibilityService enabled, and Device Admin active. The zero-permission PoC successfully reproduced the following effects:
- AdbHelper: changed Settings.Global adb_enabled 1 -> 0 -> 1
- DataRoamingHelper: changed Settings.Global data_roaming 1 -> 0 -> 1
- InversionHelper: changed accessibility_display_inversion_enabled 0 -> 1 -> 0
- AmbientHelper: changed doze_enabled
- HeadsUpHelper: changed heads_up_notifications_enabled
- OnWhileChargeHelper: changed stay_on_while_plugged_in
- ImmersiveHelper: changed policy_control to immersive.full=*
- WiFiHelper: changed Wi-Fi state
- FlashlightHelper: changed flashlight state
- PowerSaveHelper: changed battery-saver state
- RingModeHelper: changed ring mode
- HomeHelper: triggered the Android HOME global action
- LockHelper: immediately locked the device
AirplaneHelper is implemented for Shortcutter's Android 9/API 28-era behavior and is intended to toggle airplane mode on older supported Android versions, but on the tested modern Pixel 10 it was ineffective
Representative malicious Intent:
Component:
com.leedroid.shortcutter/com.leedroid.shortcutter.activities.ToggleGeneric
Extra:
Class=com.leedroid.shortcutter.tileHelpers.DataRoamingHelper
The attacking application requires no Android permissions.
Attack prerequisites are that Shortcutter is installed and the relevant Shortcutter capability has already been granted or enabled. After that setup, no additional user interaction is required for exploitation.
Remediation: make ToggleGeneric non-exported or protect it with a signature-level permission, remove arbitrary reflective helper selection from untrusted Intent data, and enforce authorization immediately before privileged helper execution. |
|---|
| 원천 | ⚠️ https://docs.google.com/document/d/1_CRu5x_2OFJc-iZCP_GI0L88rEUOlgs3TCv9jM5L-b4/edit?usp=sharing |
|---|
| 사용자 | Actuator (UID 67941) |
|---|
| 제출 | 2026. 09. 28. PM 01:17 (27 날 ago) |
|---|
| 모더레이션 | 2026. 10. 20. AM 06:46 (22 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 422658 [LeeDrOiD Labs Shortcutter 2 App 9.0.48 켜짐 Android ToggleGeneric.java Class.forName Class Local Privilege Escalation] |
|---|
| 포인트들 | 20 |
|---|