CVE-2020-0014 PoC — Android Framework 安全漏洞

Source

https://github.com/tea9/CVE-2020-0014-Toast

Associated Vulnerability

Title: Android Framework 安全漏洞 (CVE-2020-0014)
Description:It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520

Description

CVE-2020-0014-Toast-复现

Readme

## CVE-2020-0014 Toast 复现
该漏洞可使恶意 App 通过构造一个可被点击的 Toast 视图来截获用户在屏幕上的操作，以达到搜集用户密码等敏感信息的目的。  
影响范围：Android 8.0版本，8.1版本，9版本，10版本  


![log](./log.png)

只验证了可行性，未验证漏洞实际可以造成的危害  
[release](./app/release/app-release.apk)  

## LINKS

[通过安卓最新 Toast 漏洞进行 Tapjacking](https://www.anquanke.com/post/id/201052)  
[Android 安全公告](https://source.android.com/security/bulletin/2020-02-01)  
[CVE-2020-0014](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0014)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →