MagiskEoP - GitLite

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #golang #android #machine-learning #rust #docker #windows #vue #mcp #openai

MagiskEoP

(★ 199)

Exploit and writeup for installed app to root privilege escalation through CVE-2024-48336 (Magisk Bug #8279), Privileges Escalation / Arbitrary Code Execution Vulnerability

File Explorer

Download Latest Version (.zip)

- .gitignore
- compiler.xml
- deploymentTargetDropDown.xml
- gradle.xml
- jarRepositories.xml
- migrations.xml
- misc.xml
- vcs.xml
- .gitignore
- build.gradle
- proguard-rules.pro
- - gradle-wrapper.jar
  - gradle-wrapper.properties
.gitignore
build.gradle
gradle.properties
gradlew
gradlew.bat
README.md
screen-20220302-093745.mp4
settings.gradle

# Installation Guide

1. Get the code

git clone https://github.com/canyie/MagiskEoP

Downloads the entire project code from GitHub to your computer.

cd MagiskEoP

Moves into the project folder you just downloaded.

2. Gradle (Java/Kotlin)

Medium Recommended

Prerequisites

Git Needed to download the project code from GitHub.
JDK (Java) Required to build and run Java/Kotlin projects.
Gradle If the repo includes gradlew (Gradle Wrapper), you don't need to install Gradle separately.

cd app

This project's files live in a subfolder, so move into it first.

./gradlew build

Builds the project using Gradle.

✅ A BUILD SUCCESSFUL message means it worked. The output is created under build/.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## Introduction
This is an exploit for a vulnerability CVE-2024-48336 in Magisk app that allows a local app to silently gain root access without user consent.

Vulnerability was initially reported by [@vvb2060](https://github.com/vvb2060) and PoC-ed by [@canyie](https://github.com/canyie). It has been fixed in Canary 27007.

Demo video for exploit this vulnerability to silently obtaining root privileges and granting root to any app: https://github.com/canyie/MagiskEoP/blob/main/screen-20220302-093745.mp4

Steps to reproduce this vulnerability:
1. Install vulnerable Magisk app builds on a device that has no GMS preinstalled
2. Install this exploit app
3. Force stop Magisk app and this exploit app
4. Open Magisk app
5. Open this exploit app, type your commands and press Execute to execute them with root privileges

## Vulnerability Info
Name: Magisk App Arbitrary Code Execution Vulnerability

Alias: Magisk Privilege Escalation Vulnerability

### The Basics
Product: Magisk

CVE: [CVE-2024-48336](https://nvd.nist.gov/vuln/detail/CVE-2024-48336)

Reporter: [@vvb2060](https://github.com/vvb2060)

Initial Report Date: 2024-08-01

Patch Date: 2024-08-21

Disclosure Date: 2024-08-24

Affected Versions: Manager v7.0.0 ~ Canary 27006

First Patched Versions: Canary 27007

Issue/Bug report: https://github.com/topjohnwu/Magisk/issues/8279

Patch CL: https://github.com/topjohnwu/Magisk/commit/c2eb6039579b8a2fb1e11a753cea7662c07bec02

Bug-introducing CL: https://github.com/topjohnwu/Magisk/commit/920b60da19212dd8d54d27ada77a30067ce50de6

Bug Class: Unsafe Dynamic External Code Loading

Weakness Enumerations:
- [CWE-386: Symbolic Name not Mapping to Correct Object](https://cwe.mitre.org/data/definitions/386.html)
- [CWE-829: Inclusion of Functionality from Untrusted Control Sphere](https://cwe.mitre.org/data/definitions/829.html)

### Summary
The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation.

### Details
Old Android versions do not support some algorithms. To make Magisk work properly on these platforms, it tries to load conscrypt from GMS by calling [createCallingContext()](https://developer.android.com/reference/android/content/Context#createPackageContext(java.lang.String,%20int)). Check this link for more details: https://t.me/vvb2060Channel/692

However, GMS is not always preinstalled on all devices. Magisk assumes that loading code from GMS is always safe, however attackers can create a fake malicious app with the same package name. When Magisk app is launched, malicious code will get executed in Magisk app. Since Magisk app is always granted root access, this allows attackers to silently gain root access and execute arbitrary code with root privileges without user acceptance.

### Vulnerable Devices
- Devices with no GMS preinstalled
- Devices with broken signature verification implementation (e.g. Disabled by CorePatch)

Note: This issue is fixed in Canary 27007 by ensuring GMS is a system app before loading it. However, it's still possible to exploit this issue on devices with pre-installed GMS but have broken signature verification implementations (e.g. CorePatch).

Note 2: Although a fix for this issue is present in the official Magisk app, there are many other instances of similar code exist in other apps without a proper fix such as [this](https://github.com/Fox2Code/FoxMagiskModuleManager/blob/master/app/src/main/java/com/fox2code/mmm/utils/io/GMSProviderInstaller.java#L51) and [this](https://github.com/vvb2060/KeyAttestation/blob/master/app/src/main/java/io/github/vvb2060/keyattestation/AppApplication.kt#L37). This potentially allows an arbitrary code execution in vulnerable apps and potentially allows attackers to gain root access again if it is granted to victim apps.