Janus Vulnerability (CVE-2017-13156)
Last updated
Was this helpful?
Last updated
Was this helpful?
A serious vulnerability in Android allows attackers to inject a DEX file into an APK file without affecting the signatures.
On device running android version 5.X & 6.X, Apk signature was verified using only v1 scheme Janus vulnerability was found in v1 signing scheme and google released a patch on 2017 December 01 to fix Janus on these android versions. so even though apk is signed only with v1 which can bem run on 5.x & 6.x, if 2017 December 01 patch is installed in the device Janus cannot be exploited.
After releasing the patch for Janus, Google released v2 signing scheme and prioritized device to use v2 scheme over v1 scheme if v2 was used along with v1 scheme but they did not integrate the patch into the system until android 8.1. This made possible to exploit Janus on android 7.x & 8.0 also, as long as 2017 December patch is not installed.
Applications signed with v2 or v3 along with v1 are also vulnerable to Janus if they are made to run on android versions 5.x & 6.x as it verifies only v1 scheme without installing the patch.
Finally v1 scheme was removed and V4 scheme has been introduced in Android 11, Applications that are only signed with v1 scheme will not run on Android 11
Use to find the min android version on which we can run this application
To Inject this classes.dex file into our h5 application, we use this exploit code from . Copy the code and create new file named janus.py and paste into it
