CVE-2022-20138
HIGHAndroid - Missing Authorization in DevicePolicyManagerService
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2022-20138. PoCs published by Trinadh465, ShaikUsaf.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2022-20138, targeting Android's autofill framework. The code demonstrates how an attacker could manipulate autofill services to trigger unintended behavior, potentially leading to information disclosure or denial of service.
Description
In ACTION_MANAGED_PROFILE_PROVISIONED of DevicePolicyManagerService.java, there is a possible way for unprivileged app to send MANAGED_PROFILE_PROVISIONED intent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-210469972
Exploits (2)
This repository contains a proof-of-concept exploit for CVE-2022-20138, targeting Android's autofill framework. The code demonstrates how an attacker could manipulate autofill services to trigger unintended behavior, potentially leading to information disclosure or denial of service.
This repository contains a proof-of-concept exploit for CVE-2022-20138, which is a vulnerability in the Android managed provisioning framework. The exploit leverages the TrampolineActivity to bypass intended restrictions and execute arbitrary activities with elevated privileges.
References (1)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H