Exploitation Summary
EIP tracks 3 public exploits for CVE-2021-25374. PoCs published by ReversecLabs.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-25374, which leverages a Samsung Account access vulnerability via a crafted intent URL. The script automates the process of extracting authentication tokens and session cookies to gain unauthorized access to a victim's Samsung Account.
Description
An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.
Exploits (3)
This repository contains a functional exploit for CVE-2021-25374, which leverages a Samsung Account access vulnerability via a crafted intent URL. The script automates the process of extracting authentication tokens and session cookies to gain unauthorized access to a victim's Samsung Account.
This repository contains a functional exploit for CVE-2021-25374, which leverages an intent URI scheme vulnerability in Samsung Members to bypass authentication and gain unauthorized access to a victim's Samsung Account. The script automates the process of extracting session tokens and cookies by exploiting improper validation in the app's deep link handling.
This repository contains a functional exploit for CVE-2021-25374, which leverages an intent-based attack to bypass authentication and gain unauthorized access to Samsung accounts. The script automates the process of extracting session tokens and cookies by exploiting a vulnerability in the Samsung Members app.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N