CVE-2019-2205 PoC — Android System组件资源管理错误漏洞

Source

Associated Vulnerability

Title: Android System组件资源管理错误漏洞 (CVE-2019-2205)
Description:In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139806216

Description

A local PoC exploit for CVE-2019-2205

Readme

# PACPoC: A local PoC exploit for CVE-2019-2205

To try out this exploit install the "malicious" app PacTest.apk and make `exploit.pac` available over http with, for example `python -m SimpleHTTPServer`. Then go to proxy settings on an Android device, select proxy autoconfig, and enter the URL to `exploit.pac`.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →