MEXC Android RCE via Backslash URL Validation Bypass, Unprot...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://itis911.github.io/writeups/RCE-Mexc-Andriod-App.html
• Blog Title: MEXC Android RCE via Backslash URL Validation Bypass, Unprotected WebView Bridge, Path Traversal, and DXRisk Cache Poisoning
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Webview Attacks; consider a dedicated subsection for WebView bridge abuse, deep-link URL parser differentials, Android arbitrary file writes, and native-library cache poisoning

🎯 Content Summary

Overview and impact. The post documents a high-impact, app-level native remote-code-execution chain in the MEXC Android application, package com.mexcpro.client. The chain combines a backslash-based URL whitelist bypass, an unprotected WebView JavaScript bridge, filename path traversal, and poisoning of the DXRisk anti-fraud SDK native-library cache. The attacker does not need root, application debugging, or prior local access; the victim only needs to open a craf...

🔧 Technical Details

Custom signed-API request replication. When an API relies on a client-side signature, reproduce the exact nonce, token handling, body serialization, and hash sequence. In this case, calculate nonce = current_timestamp_ms + server_offset, use the session cookie value or an empty token, compute inner = md5(token + nonce)[7:], serialize the body as sorted-key application/x-www-form-urlencoded, and calculate sign = md5(nonce + content + inner). Matching the client implementation can make otherwise rejected requests appear valid to an endpoint whose signature is the primary control.

Backslash URL-parser differential. A whitelist can be bypassed when the server and browser parse backslashes differently. A payload such as https://attacker.example\@trusted.example may be interpreted by a server as using trusted.example as the host because the backslash remains in the us...

🤖 Agent Actions

Plan:

1. Map relevant Android/WebView, URL-validation, file-write, and native-loading pages.
2. Read at least five candidate files and check for duplication.
3. Add one concise, source-cited section in the best existing page.
4. Validate Markdown, references, diff, and repository status.
   Repository review is complete: the best fit is the existing webview-attacks.md page. The URL backslash primitive is already documented elsewhere, so I’ll avoid duplicating it and add only the new cross-layer bridge-to-cache-poisoning technique in this page.
   I’ll now add the concise exploitation/audit subsection and append four numbered references, preserving the page’s existing structure and reference numbering.
   Updated src/mobile-pentesting/android-app-pentesting/webview-attacks.md.

Added:

• Independent WebView bridge auditing.
• Base64/blob bridge path traversal to arbitrary file write.
• Native-library cache poisoning via code_cache.
• ZIP-disguised .so structure, alignment, and loader requirements.
• SELinux execute versus execute_no_trans distinction.
• Practical static/runtime triage commands and technical hardening.
• Four numbered, cited references.

Validation:

• git diff --check passed.
• Markdown fences and reference numbering validated.
• All added reference URLs returned HTTP 200.
• mdbook build was unavailable because mdbook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://itis911.github.io/writeups/RCE-Mexc-Andriod-App.html

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Webview Attacks; consider a dedicated subsection for WebView bridge abuse, deep-link URL parser differentials, Android arbitrary file writes, and native-library cache poisoning".

Repository Maintenance:

• MD Files Formatting: 1032 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0