CVE-2013-4710
Android 3.0-4.1.x - Remote Code Execution via WebView.addJavascriptInterface
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-4710. PoCs published by Metasploit, Snip3R69.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in Android < 4.2's WebView component by injecting JavaScript that leverages the addJavascriptInterface method to execute arbitrary commands via Java Reflection APIs.
Description
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.
Exploits (3)
This Metasploit module exploits a privilege escalation vulnerability in Android < 4.2's WebView component by injecting JavaScript that leverages the addJavascriptInterface method to execute arbitrary commands via Java Reflection APIs.
This repository contains a proof-of-concept exploit for CVE-2013-4710, demonstrating how JavaScript in a WebView can execute arbitrary commands on Android devices via reflection. The exploit leverages the `addJavascriptInterface` method to gain RCE by accessing the `Runtime` class.
This Metasploit module exploits a privilege escalation vulnerability in Android < 4.2's WebView component by leveraging the addJavascriptInterface method to execute arbitrary commands via Java Reflection APIs. It serves malicious JavaScript to vulnerable Android browsers or WebViews, leading to remote code execution.