Reproducing the Acode v1.10.5 Cordova WebView Zero-Day

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://hackmd.io/@sal/Reproducing-the-Acode-Zero-Day-Vulnerability
• Blog Title: Reproducing the Acode v1.10.5 Cordova WebView Zero-Day
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > WebView Attacks, with cross-references from content:// protocol, Intent Injection, Exploiting Content Providers, and Cordova Apps

🎯 Content Summary

Overview

The post reproduces an unassigned zero-day vulnerability in Acode v1.10.5, an open-source Android code editor built with Apache Cordova. The flaw is a stored/second-order XSS caused by inserting an attacker-controlled filename into a custom alert through innerHTML. A malicious Android application can exploit it by serving a virtual file from its own ContentProvider, using an exported Acode activity to open that file, making the provi...

🔧 Technical Details

Tracing untrusted metadata into a WebView HTML sink: Review custom dialog and rendering helpers for assignments to innerHTML, then trace every caller to identify externally controlled values. A filename, URI label, document title, MIME metadata, or provider-supplied display name becomes executable when it is interpolated into a message and rendered as HTML without sanitization. A generic event-handler payload such as <img src=x onerror='PAYLOAD'> turns control over metadata into JavaScript execution.

Second-order XSS through resource lifecycle changes: Applications may safely open and store attacker-controlled metadata at one point but render it through a dangerous UI path later. If an application shows the stored filename only when a resource is modified or deleted, first make it retain a malicious display name and then make the backing resource unavailable. Trigger the relevant refresh, resume, error, or ...

🤖 Agent Actions

Updated:

src/mobile-pentesting/android-app-pentesting/webview-attacks.md

Added:

• Second-order XSS tracing from ContentProvider metadata to WebView sinks.
• Stateful virtual-file provider testing harness.
• Exported file-handler and resume lifecycle trigger example.
• Cordova-context-preserving DOM replacement technique.
• Technical remediation guidance.
• Numbered citations crediting the original report, reproduction blog, Acode source, and official Android/Cordova documentation.

Validation completed:

• git diff --check passed.
• References and citations are contiguous and matched.
• All added reference URLs returned HTTP 200.
• No forbidden sources were introduced.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://hackmd.io/@sal/Reproducing-the-Acode-Zero-Day-Vulnerability

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > WebView Attacks, with cross-references from content:// protocol, Intent Injection, Exploiting Content Providers, and Cordova Apps".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0