Jump to content

Expert found a 1-Click RCE in the TikTok App for Android


Recommended Posts

Expert found a 1-Click RCE in the TikTok App for Android

 

Egyptian security researcher Sayed Abdelhafiz discovered multiple bugs in TikTok Android Application that can be chained to achieve Remote code execution.

 

Egyptian security researcher Sayed Abdelhafiz discovered multiple vulnerabilities in the TikTok Android Application that can be chained to achieve Remote code execution.

“While testing TikTok for Android Application, I identified multiple bugs that can be chained to achieve Remote code execution that can be triaged through multiple dangerous attack vectors.” Abdelhafiz wrote.

 

The list of vulnerabilities discovered by the expert are:

  • Universal XSS on TikTok WebView
  • Another XSS on AddWikiActivity
  • Start Arbitrary Components
  • Zip Slip in TmaTestActivity
  • RCE!

 

The researcher provided technical details for each of the above vulnerabilities and finally explained how to chain them to achieve remote code execution.

 

The expert created a zip file and path traversed the filename to overwrite the libjsc.so file: 

 

/data/data/com.zhiliaoapp.musically/app_lib/df_rn_kit/df_rn_kit_a3e37c20900a22bc8836a51678e458f7/arm64-v8a/libjsc.so

 

Then he overwrote the native-libraries with a malicious library created to execute his code. The expert initially noticed that the code will be executed at the successive restart of the Application, so he attempted to find a way to reload the library without relaunching the application. This was possible by launching the Activity: 

com.tt.miniapphost.placeholder.MiniappTabActivity0 

 

The expert also published final PoC for the RCE and reported the issue to the TikTok Security team that quickly addressed them. Below the list of actions taken by TikTok:

  • The vulnerable XSS code has been addressed;
  • TmaTestActivity has been deleted
  • The security team implemented restrictions to intent scheme that doesn’t allow an intent for TikTok Application on AddWikiActivity and Main WebViewActivity.

 

 

Source: Expert found a 1-Click RCE in the TikTok App for Android

Link to post
Share on other sites
  • Replies 0
  • Created
  • Last Reply

Top Posters In This Topic

  • mood

    1

Popular Days

Top Posters In This Topic

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...