CVE-2020-7745
📋 TL;DR
CVE-2020-7745 is a backdoor vulnerability in MintegralAdSDK that allows Mintegral and their advertising partners to remotely execute arbitrary code on user devices. This affects all applications that integrate the vulnerable SDK version, potentially compromising millions of mobile devices.
💻 Affected Systems
- MintegralAdSDK
📦 What is this software?
Mintegraladsdk by Mintegral
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to steal sensitive data, install additional malware, or join devices to botnets.
Likely Case
Advertisers executing unauthorized code to collect user data, display malicious ads, or perform click fraud.
If Mitigated
Limited data collection or ad fraud if network controls block malicious domains.
🎯 Exploit Status
The backdoor functionality is intentionally built into the SDK. Attackers can trigger it through normal ad network communications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.6.0.0 and later
Vendor Advisory: https://www.mintegral.com/en/
Restart Required: Yes
Instructions:
1. Update MintegralAdSDK to version 6.6.0.0 or later. 2. Rebuild and redeploy affected mobile applications. 3. Test application functionality after update.
🔧 Temporary Workarounds
Network Blocking
allBlock communication with Mintegral ad servers at network level
SDK Removal
allRemove MintegralAdSDK from applications and replace with alternative ad SDK
🧯 If You Can't Patch
- Isolate affected devices on segmented network with restricted internet access
- Implement application allowlisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check application dependencies for MintegralAdSDK version below 6.6.0.0. For iOS: check Podfile.lock. For Android: check build.gradle dependencies.Check Version:
iOS: grep -r 'MintegralAdSDK' Podfile.lock; Android: grep -r 'com.mintegral' build.gradleVerify Fix Applied:
Confirm MintegralAdSDK version is 6.6.0.0 or higher in application dependencies and monitor for suspicious network traffic to Mintegral domains.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from ad-related processes
- Suspicious network connections to Mintegral domains
Network Indicators:
- HTTP requests to Mintegral ad servers with unusual payloads
- Unexpected outbound connections from mobile apps
SIEM Query:
source="mobile_device" AND (dest_ip IN mintegral_ips) AND (http_user_agent CONTAINS "Mintegral")🔗 References
- https://snyk.io/blog/remote-code-execution-rce-sourmint/
- https://snyk.io/research/sour-mint-malicious-sdk/%23rce
- https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-1019377
- https://www.youtube.com/watch?v=n-mEMkeoUqs
- https://snyk.io/blog/remote-code-execution-rce-sourmint/
- https://snyk.io/research/sour-mint-malicious-sdk/%23rce
- https://snyk.io/vuln/SNYK-COCOAPODS-MINTEGRALADSDK-1019377
- https://www.youtube.com/watch?v=n-mEMkeoUqs
