CVE-2014-8609
Android < 4.4.4 - Unauthenticated Intent Broadcast via PendingIntent Leak
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-8609. PoCs published by ratiros01, MazX0p, locisvv.
AI-analyzed exploit summary This repository contains a functional PoC exploit for CVE-2014-8609, which leverages a PendingIntent vulnerability in Android to execute arbitrary intents with elevated privileges. The exploit demonstrates how a malicious app can trigger a factory reset via the MASTER_CLEAR intent.
Description
The addAccount method in src/com/android/settings/accounts/AddAccountSettings.java in the Settings application in Android before 5.0.0 does not properly create a PendingIntent, which allows attackers to use the SYSTEM uid for broadcasting an intent with arbitrary component, action, or category information via a third-party authenticator in a crafted application, aka Bug 17356824.
Exploits (3)
This repository contains a functional PoC exploit for CVE-2014-8609, which leverages a PendingIntent vulnerability in Android to execute arbitrary intents with elevated privileges. The exploit demonstrates how a malicious app can trigger a factory reset via the MASTER_CLEAR intent.
This repository contains a writeup and a video PoC for CVE-2014-8609, a PendingIntent vulnerability in Android applications. The description is in Arabic and explains how the vulnerability works and how it can be exploited.
This PoC demonstrates CVE-2014-8609, an Android vulnerability where a malicious app can trigger a factory reset via PendingIntent manipulation in the AccountAuthenticatorService. The exploit abuses the 'android.intent.action.MASTER_CLEAR' intent to reset the device.