WooYun.org

爱奇艺pps远程命令执行漏洞，通过浏览恶意网页就会受到远程命令执行漏洞攻击，所有Android版本都受影响。
org.qiyi.android.video.activitys.FrameJumpActivity组件对外导出：
<activity android:configChanges="keyboardHidden|orientation" android:name="org.qiyi.android.video.activitys.FrameJumpActivity" android:screenOrientation="portrait" android:theme="@android:style/Theme.NoDisplay">
<intent-filter>
<data android:host="tv.pps.mobile" android:scheme="iqiyi-phone" />
<data android:pathPattern=".*res*" />
<category android:name="android.intent.category.DEFAULT" />
<action android:name="android.intent.action.VIEW" />
<category android:name="android.intent.category.BROWSABLE" />
</intent-filter>
</activity>
定义了iqiyi-phone://tv.pps.mobile这个伪协议，path格式为：.*res*.，因此通过iqiyi-phone://tv.pps.mobile/res就可以将该组件调起来。
查看onCreate函数：
protected void onCreate(Bundle arg2) {
super.onCreate(arg2);
this.a = ((Context)this);
this.onNewIntent(this.getIntent());
}
进入onNewIntent函数：
protected void onNewIntent(Intent arg4) {
super.onNewIntent(arg4);
Uri v0 = arg4.getData();
if(v0 != null && ("iqiyi-phone".equals(v0.getScheme()))) {
this.a(v0);
}
this.finish();
}
如果协议是iqiyi-phone进入a函数：
private void a(Uri uri) {
try {
int pid = this.a(uri.getQueryParameter("pid"));
String uristring = uri.toString();
switch(pid) {
case 8: {
goto label_6;
}
case 10: {
goto label_27;
}
}
return;
label_6:
if(StringUtils.isEmpty(uristring)) {
goto label_24;
}
if(uristring.indexOf("url=") == -1) {
goto label_24;
}
g.b(URLDecoder.decode(uristring.substring(uristring.indexOf("url=") + 4)), ((Activity)this));
return;
}
首先获取pid参数，如果pid＝8，获取url的值，将url解码后传给g.b函数，经过一系列调用后最后到达这里：
private void a(String arg5, Activity arg6, int arg7) {
String v0 = arg7 == 2 ? this.b(arg5, arg6) : this.a(arg5, arg6);
aux.a(this.b, "Action url is " + v0);
if(!StringUtils.isEmpty(v0)) {
Intent v1 = new Intent(((Context)arg6), BillboardActivity.class);
v1.putExtra("intent_purpose", "showBillboardWebview");
v1.putExtra("url", v0);
v1.putExtra("action_type", arg7);
v1.putExtra("INTENT_SOURCE", this.d);
v1.putExtra("INTENT_IS_REDDOT", this.e);
v1.putExtra("title", "活动");
arg6.startActivity(v1);
}
}
将url参数传递进去，调起BillboardActivity组件：
protected void onNewIntent(Intent arg5) {
int v3 = 2;
String v0 = arg5.getStringExtra("intent_purpose");
this.m = arg5.getIntExtra("action_type", 1);
if(this.m == v3) {
this.d();
}
else {
this.g = com3.a().b();
}
if(!StringUtils.isEmpty(v0)) {
String v1 = arg5.getStringExtra("title");
if(!StringUtils.isEmpty(v1) && this.k != null) {
this.k.a(v1);
}
this.setTitle(((CharSequence)v1));
if(!v0.equals("showBillboardWebview")) {
return;
}
v0 = arg5.getStringExtra("url");
if(StringUtils.isEmpty(v0)) {
return;
}
if(this.e == null) {
this.a(v0, this.m);
return;
}
if(this.m == v3) {
this.k.b(v0);
return;
}
this.k.c(v0);
}
}
最后通过k.c函数将url加载起来。
k类导出qiyi这个js接口：
private WebView z() {
this.f = org.iqiyi.video.k.com1.d().b().inflate(com1.c("qiyi_sdk_phone_common_webview"), null);
View v0 = this.f.findViewById(com1.b("phone_common_webview"));
((WebView)v0).setOnLongClickListener(new o(this));
((WebView)v0).getSettings().setJavaScriptEnabled(true);
((WebView)v0).getSettings().setDefaultTextEncodingName("UTF-8");
if(Build$VERSION.SDK_INT >= 14) {
((WebView)v0).getSettings().setPluginState(WebSettings$PluginState.ON);
}
((WebView)v0).getSettings().setUseWideViewPort(true);
((WebView)v0).getSettings().setLoadWithOverviewMode(true);
((WebView)v0).getSettings().setLoadsImagesAutomatically(true);
((WebView)v0).getSettings().setDatabaseEnabled(true);
((WebView)v0).getSettings().setDomStorageEnabled(true);
((WebView)v0).setScrollBarStyle(0);
((WebView)v0).getSettings().setSupportZoom(true);
((WebView)v0).requestFocus();
((WebView)v0).requestFocusFromTouch();
((WebView)v0).addJavascriptInterface(new s(this), "qiyi");
return ((WebView)v0);
}
由于url可控，并且导出了js接口并定义了伪协议，浏览恶意网页就会受到远程命令执行漏洞攻击。
由于targetSdkVersion="14" ，所有Android版本都受影响：
<uses-sdk android:minSdkVersion="9" android:targetSdkVersion="14" />