CVE-2023-21272
HIGHAndroid - Local Privilege Escalation via URI Permission Grant
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2023-21272. PoCs published by pazhanivel07, Trinadh465.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2023-21272, targeting Android's Autofill framework. The test cases demonstrate how autofill services can be manipulated to trigger unintended behavior, potentially leading to information disclosure or denial of service.
Description
In readFrom of Uri.java, there is a possible bad URI permission grant due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Exploits (2)
This repository contains a proof-of-concept exploit for CVE-2023-21272, targeting Android's Autofill framework. The test cases demonstrate how autofill services can be manipulated to trigger unintended behavior, potentially leading to information disclosure or denial of service.
This repository contains a proof-of-concept exploit for CVE-2023-21272, targeting Android's ActivityManager service. The exploit leverages a vulnerability in the `Am.java` file to potentially achieve privilege escalation or unauthorized command execution.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H