Expert found a 1-Click RCE in the TikTok App for Android

Source: Messagero

Egyptian security researcher Sayed Abdelhafiz discovered multiple bugs in TikTok Android Application that can be chained to achieve Remote code execution.

Egyptian security researcher Sayed Abdelhafiz discovered multiple vulnerabilities in the TikTok Android Application that can be chained to achieve Remote code execution.

“While testing TikTok for Android Application, I identified multiple bugs that can be chained to achieve Remote code execution that can be triaged through multiple dangerous attack vectors.” Abdelhafiz wrote.

The list of vulnerabilities discovered by the expert are:

Universal XSS on TikTok WebView
Another XSS on AddWikiActivity
Start Arbitrary Components
Zip Slip in TmaTestActivity
RCE!

The researcher provided technical details for each of the above vulnerabilities and finally explained how to chain them to achieve remote code execution.

The expert created a zip file and path traversed the filename to overwrite the libjsc.so file:

/data/data/com.zhiliaoapp.musically/app_lib/df_rn_kit/df_rn_kit_a3e37c20900a22bc8836a51678e458f7/arm64-v8a/libjsc.so

Then he overwrote the native-libraries with a malicious library created to execute his code. The expert initially noticed that the code will be executed at the successive restart of the Application, so he attempted to find a way to reload the library without relaunching the application. This was possible by launching the Activity:

com.tt.miniapphost.placeholder.MiniappTabActivity0

The expert also published final PoC for the RCE and reported the issue to the TikTok Security team that quickly addressed them. Below the list of actions taken by TikTok:

The vulnerable XSS code has been addressed;
TmaTestActivity has been deleted
The security team implemented restrictions to intent scheme that doesn’t allow an intent for TikTok Application on AddWikiActivity and Main WebViewActivity.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Exchange)

[adrotate banner=”5″]

[adrotate banner=”13″]

TikTok for Android 1-Click RCE

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.