CyberRota Analysis
AI-GeneratedAcode versions 1.11.6 to 1.12.7 on Android are vulnerable due to an exported service that lacks binding permissions and caller verification, allowing any installed app to execute arbitrary commands with elevated privileges. This vulnerability can lead to unauthorized access to Acode's private data, remote credentials, and runtime permissions, posing a significant risk to user security. Developers and security teams managing applications that interact with Acode should prioritize updating to version 1.12.7 to mitigate this high-severity issue.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an attacker-controlled cmd value, which the terminal implementation passes to ProcessBuilder with sh -c inside Acode's UID. This allows a zero-permission local application to execute commands with access to Acode private data, remote credentials, Storage Access Framework grants, and runtime permissions without additional interaction at attack time. This issue is fixed in version 1.12.7.