{"action":"created","issue":{"url":"https://api.github.com/repos/jackpal/Android-Terminal-Emulator/issues/374","labels_url":"https://api.github.com/repos/jackpal/Android-Terminal-Emulator/issues/374/labels{/name}","comments_url":"https://api.github.com/repos/jackpal/Android-Terminal-Emulator/issues/374/comments","events_url":"https://api.github.com/repos/jackpal/Android-Terminal-Emulator/issues/374/events","html_url":"https://github.com/jackpal/Android-Terminal-Emulator/issues/374","id":55261348,"number":374,"title":"security issue: execute arbitrary commands without the RUN_SCRIPT permission","user":{"login":"daoyuan14","id":7311190,"avatar_url":"https://avatars.githubusercontent.com/u/7311190?v=3","gravatar_id":"","url":"https://api.github.com/users/daoyuan14","html_url":"https://github.com/daoyuan14","followers_url":"https://api.github.com/users/daoyuan14/followers","following_url":"https://api.github.com/users/daoyuan14/following{/other_user}","gists_url":"https://api.github.com/users/daoyuan14/gists{/gist_id}","starred_url":"https://api.github.com/users/daoyuan14/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daoyuan14/subscriptions","organizations_url":"https://api.github.com/users/daoyuan14/orgs","repos_url":"https://api.github.com/users/daoyuan14/repos","events_url":"https://api.github.com/users/daoyuan14/events{/privacy}","received_events_url":"https://api.github.com/users/daoyuan14/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-01-23T09:31:37Z","updated_at":"2015-01-24T12:10:46Z","closed_at":null,"body":"According to this page (https://github.com/jackpal/Android-Terminal-Emulator/wiki/Launching-Terminal-Emulator-for-Android-from-another-App), only apps with the RUN_SCRIPT permission can invoke Terminal Emulator to execute commands.\r\n\r\nBut I found the permission is not necessary. I can do this by explicitly specifying the RemoteInterface component. For example,\r\n```\r\n$ adb shell am start -n jackpal.androidterm/.RemoteInterface -a jackpal.androidterm.RUN_SCRIPT --es jackpal.androidterm.iInitialCommand pwd\r\n```\r\n**The security consequence is that a local attack app can execute arbitrary commands in the identify of Terminal Emulator, such as exporting its private files to the public SD card (by using the cp command).**\r\n\r\nThe cause is due to the exposed terminal command component, \"RemoteInterface\" (https://github.com/jackpal/Android-Terminal-Emulator/blob/master/term/src/main/AndroidManifest.xml#L55). Android by default exports the components registered with intent filters. So set permission to protect the \"RunScript\" component (https://github.com/jackpal/Android-Terminal-Emulator/blob/master/term/src/main/AndroidManifest.xml#L74) is not enough.\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/jackpal/Android-Terminal-Emulator/issues/comments/71314111","html_url":"https://github.com/jackpal/Android-Terminal-Emulator/issues/374#issuecomment-71314111","issue_url":"https://api.github.com/repos/jackpal/Android-Terminal-Emulator/issues/374","id":71314111,"user":{"login":"daoyuan14","id":7311190,"avatar_url":"https://avatars.githubusercontent.com/u/7311190?v=3","gravatar_id":"","url":"https://api.github.com/users/daoyuan14","html_url":"https://github.com/daoyuan14","followers_url":"https://api.github.com/users/daoyuan14/followers","following_url":"https://api.github.com/users/daoyuan14/following{/other_user}","gists_url":"https://api.github.com/users/daoyuan14/gists{/gist_id}","starred_url":"https://api.github.com/users/daoyuan14/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daoyuan14/subscriptions","organizations_url":"https://api.github.com/users/daoyuan14/orgs","repos_url":"https://api.github.com/users/daoyuan14/repos","events_url":"https://api.github.com/users/daoyuan14/events{/privacy}","received_events_url":"https://api.github.com/users/daoyuan14/received_events","type":"User","site_admin":false},"created_at":"2015-01-24T12:10:46Z","updated_at":"2015-01-24T12:10:46Z","body":"I think your fix should be ok.\r\n\r\nNormally, adb shell requires permission. But if you run your adb as root, the permission can be skiped.\r\n\r\nThe normal adb case is like:\r\n$ adb shell am start -n jackpal.androidterm/.RunScript -a jackpal.androidterm.RUN_SCRIPT --es jackpal.androidterm.iInitialCommand pwd\r\nStarting: Intent { act=jackpal.androidterm.RUN_SCRIPT cmp=jackpal.androidterm/.RunScript (has extras) }\r\njava.lang.SecurityException: Permission Denial: starting Intent { act=jackpal.androidterm.RUN_SCRIPT flg=0x10000000 cmp=jackpal.androidterm/.RunScript (has extras) } from null (pid=17812, uid=2000) requires jackpal.androidterm.permission.RUN_SCRIPT"}}