CVE-2025-14517
📋 TL;DR
This vulnerability in Yalantis uCrop library allows improper export of Android application components, potentially enabling local attackers to spoof intents or perform SSRF attacks. It affects Android applications using uCrop 2.2.11 for image cropping functionality. The vulnerability requires local access to the device for exploitation.
💻 Affected Systems
- Yalantis uCrop Android library
📦 What is this software?
Ucrop by Yalantis
⚠️ Risk & Real-World Impact
Worst Case
Local attacker could execute arbitrary activities, access sensitive app data, or perform server-side request forgery to internal network resources.
Likely Case
Malicious app on same device could intercept or manipulate image cropping operations, potentially accessing or modifying user images.
If Mitigated
With proper Android permissions and sandboxing, impact limited to data within the vulnerable app's scope.
🎯 Exploit Status
Exploit requires local app installation or physical device access. Public disclosure includes technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider removing or replacing uCrop library with alternative solution.
🔧 Temporary Workarounds
Manifest configuration fix
allModify AndroidManifest.xml to properly configure UCropActivity export attribute
Edit AndroidManifest.xml: Set android:exported="false" for UCropActivity if not needed externally, or implement proper intent filters and permissions
🧯 If You Can't Patch
- Implement runtime permission checks and input validation for UCropActivity intents
- Use Android's permission system to restrict which apps can interact with UCropActivity
🔍 How to Verify
Check if Vulnerable:
Check if app uses uCrop 2.2.11 and inspect AndroidManifest.xml for UCropActivity with improper export configurationCheck Version:
Check build.gradle dependencies for 'com.yalantis:ucrop:2.2.11'Verify Fix Applied:
Verify UCropActivity has proper android:exported attribute and intent filters in AndroidManifest.xml📡 Detection & Monitoring
Log Indicators:
- Unexpected intent calls to UCropActivity
- Permission denial logs for UCropActivity access attempts
Network Indicators:
- Unexpected outbound requests from app following image cropping operations
SIEM Query:
Android logs: activity UCropActivity with suspicious intent parameters or from untrusted source packages🔗 References
- https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446#469832583e0444dcb3d08b0ca661d1c6
- https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446?source=copy_link
- https://vuldb.com/?ctiid.335855
- https://vuldb.com/?id.335855
- https://vuldb.com/?submit.702811
