CVE-2020-8913: Android Play Core Library RCE Vulnerability

CVE-2020-8913 Overview

A local arbitrary code execution vulnerability exists in the SplitCompat.install endpoint in Android's Play Core Library versions prior to 1.7.2. This vulnerability allows a malicious attacker to create an APK that targets a specific application. If a victim installs this malicious APK, the attacker can perform a directory traversal attack, execute code as the targeted application, and access the targeted application's data on the Android device.

Critical Impact

Attackers can achieve arbitrary code execution within the context of any vulnerable application using the Play Core Library, gaining access to sensitive application data and potentially compromising user privacy and device security.

Affected Products

• Android Play Core Library versions prior to 1.7.2

Discovery Timeline

• 2020-08-12 - CVE CVE-2020-8913 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-8913

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) and CWE-281 (Improper Preservation of Permissions). The flaw resides in the SplitCompat.install endpoint within Android's Play Core Library, which fails to properly validate file paths during the installation of dynamic feature modules.

The Play Core Library enables applications to download and install dynamic feature modules on demand. However, due to insufficient path validation in versions before 1.7.2, an attacker can craft a malicious APK containing directory traversal sequences. When the victim installs this APK, the attacker can write arbitrary files to directories owned by the targeted application, ultimately achieving code execution within the application's context.

Root Cause

The root cause of this vulnerability is improper input validation in the SplitCompat.install function. The endpoint does not adequately sanitize file paths contained within APK modules, allowing directory traversal sequences (such as ../) to escape the intended installation directory. This path traversal weakness (CWE-22) combined with improper permission handling (CWE-281) enables an attacker to overwrite critical application files or inject malicious code.

Attack Vector

The attack requires user interaction where the victim must install a malicious APK crafted by the attacker. The malicious APK is designed to target a specific application that uses a vulnerable version of the Play Core Library. Once installed, the attack chain proceeds as follows:

1. The malicious APK contains specially crafted file paths with directory traversal sequences
2. When the Play Core Library processes these modules via SplitCompat.install, it fails to validate the paths
3. The attacker's payload is written to arbitrary locations within the targeted application's data directory
4. The attacker achieves code execution as the targeted application
5. The attacker gains access to all data and permissions held by the targeted application

The vulnerability is particularly dangerous because it affects any application using vulnerable versions of the Play Core Library, potentially impacting millions of Android users across thousands of apps.

Detection Methods for CVE-2020-8913

Indicators of Compromise

• Unexpected APK installations from untrusted sources attempting to interact with applications using the Play Core Library
• Unusual file system activity in application-specific directories, particularly files appearing outside expected module directories
• Applications exhibiting unexpected behavior or accessing resources they typically wouldn't access
• Log entries showing path traversal patterns (sequences containing ../) in file operations related to dynamic module installation

Detection Strategies

• Monitor for APK installations from unknown or untrusted sources on Android devices
• Implement application integrity checking to detect unauthorized modifications to application files
• Use mobile threat defense solutions to identify malicious APKs attempting to exploit Play Core Library vulnerabilities
• Analyze application dependency manifests to identify apps using vulnerable Play Core Library versions (< 1.7.2)

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions capable of monitoring Android device activity
• Enable detailed logging for file system operations on managed devices
• Implement network monitoring to detect communication from potentially compromised applications
• Regularly audit installed applications and their dependencies for known vulnerabilities

How to Mitigate CVE-2020-8913

Immediate Actions Required

• Update the Play Core Library to version 1.7.2 or later in all Android applications
• Audit all applications in your organization's mobile fleet to identify those using vulnerable Play Core Library versions
• Advise users to avoid installing APKs from untrusted sources
• Consider temporarily disabling dynamic feature module installations if immediate patching is not possible

Patch Information

Google has addressed this vulnerability in Play Core Library version 1.7.2. Application developers must update their dependency to the patched version and release updated applications to users. Detailed release notes are available in the Android Developer Release Notes.

For technical details on the vulnerability discovery, refer to the Oversecured Blog Post.

Workarounds

• Restrict application installations to only those from trusted sources such as Google Play Store
• Implement mobile device management (MDM) policies to control which applications can be installed
• Educate users about the risks of side-loading APKs from untrusted sources
• Consider using application sandboxing solutions to limit the impact of potential exploitation

# Gradle dependency update example
# Update your app's build.gradle file to use the patched version:
implementation 'com.google.android.play:core:1.7.2'

# Verify the dependency version after update
./gradlew dependencies | grep play-core