Android Studio has an issue where a malicious project can execute a custom cmd.exe allowing for privilege escalation. Google does not believe this is an issue.
Video and POC here : https://www.youtube.com/watch?v=hAPkSGxh9H0
When you open a project in android studio, if gradle-wrapper.properties set
distributionUrl=https://
services.gradle.org/distributions/gradle-2.6-all.zip
<https://www.google.com/url?q=http://services.gradle.org/distributions/gradle-2.6-all.zip&sa=D&usg=AFQjCNHSuog_mDHXLFUDcfXdMkVSqzfLug>,
then android studio will download and extract gradle-2.6-all.zip, jar file
in this zip will be executed by java.exe. There is a
plexus-interpolation-1.14.jar in gradle-2.6libplugins and we can find
source code here :
https://repo1.maven.org/maven2/org/codehaus/plexus/plexus-interpolation/1.14/
<https://www.google.com/url?q=https://repo1.maven.org/maven2/org/codehaus/plexus/plexus-interpolation/1.14/&sa=D&usg=AFQjCNHtoSofswZo0lkVN0AR6u2o5BAC6w>
in
plexus-interpolation-1.14-sourcesorgcodehausplexusinterpolationosOperatingSystemUtils.java
we can find code like:
exec( "cmd.exe /c set" );
"C:Program FilesAndroidAndroid Studiobinstudio64.exe" created
"C:Program FilesAndroidAndroid Studiojrebinjava.exe" and java.exe is
running under project directory. So if there is a cmd.exe in project
directory it will be executed. Attacker can send a malicious project to
victim to get remote code execution.
Timeline
Nov 25, 2020 : reported to google VRP
Nov 25, 2020 : confirm received
Nov 26, 2020 : triaged
Nov 28, 2020 : "this might not be severe enough to qualify for a reward,
though the panel will take a look at the next meeting and we'll update you
once we've got more information"
Dec 16, 2020 : "We have notified the team about this issue, they will
review your report and decide whether they want to make a change or not.
Thanks for letting us know. Regarding our Vulnerability Reward Program, the
panel decided this issue's security impact does not meet the criteria to
qualify for a reward in the program, so we won't be issuing a reward at
this time"
Dec 16, 2020 : asked why no bounty for this
Dec 16, 2020 : "Opening untrusted code with IDEs is just inherently
insecure. You have to trust the code you open in an IDE. We could add a
modal dialog warning after opening any project that you should only open
trusted projects, but developers are aware of this already. For example,
practically all build system allows executing code if an attacker controls
the config files, and that's something that can't be fixed and everyone
knows it. And if you open a project in an IDE, you'll most likely want to
build it"
This is ridiculous. I replied : "If this happens on Xcode or Visual Studio,
I will agree with you. But this is android studio, and apk cannot just run
on PC. Also the malicious code execute when open the project, do not
require take any other actions like build or debug. In my poc every file
just looks normal not suspicious except the cmd.exe, which attacker can
also set it attribute to hidden. From a developer's point of view, no one
will believe open a project in android studio cause malicious code execute
on PC"
google replied : "Android vs desktop IDE doesn't make much difference I
think. I wouldn't run a malicious APK in the android studio emulator, since
it is not a security boundary. Also, I wouldn't assume that the build
system works very differently for building an APK than building an EXE
file. And all projects are built upon opening, it is a prerequisite for
making essential features of the IDE work"
I knew I cannot persuade google give me bounty so I asked for public
disclosure, and google agreed. Now I want to explain why I think this is a
serious problem also the reason why google refused to give me bounty is
ridiculous again.
*1.except cmd.exe everything else are just normal files.*
*2.cmd.exe will be executed after open the project, do not require take any
other actions like build or debug.*
*3.even if you open and build a project like source code of some android
malware, apk cannot run on PC, it cannot affect your PC. This is very
different from Xcode or Visual Studio.*
Last time I reported LPE in another google desktop product and they said : "As
a part of our Vulnerability Reward Program, we decided that it does not
meet the bar for a financial reward, but we would like to acknowledge your
contribution to Google security in our Hall of Fame". I did not
complain. Now same thing just happen again even I found RCE. So F***
ridiculous to hear something like this, yes, it is a vaild vulnerability
but we just do not want to pay even reward amounts for your vulnerability
are listed in https://www.google.com/about/appsecurity/reward-program/.
F*** you google.
