CVE-2025-20974

Executive Summary

CVE-2025-20974 is a local privilege escalation vulnerability in the PackageInstallerCN application, a package installer utility for Android devices. The flaw stems from improper handling of insufficient permissions, specifically a failure to enforce user interaction for requested installations. A local attacker with low privileges can bypass the user consent prompt, allowing them to silently install arbitrary packages. This can lead to the installation of malicious applications without the user's knowledge or approval.

The vulnerability affects all versions of PackageInstallerCN prior to 15.0.11.0. The CVSS v3.1 base score is 6.1 (Medium), with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. The attack vector is local, requiring the attacker to have a foothold on the device. The primary impact is on integrity, as the attacker can install unauthorized software.

Supply Chain & Package Security

This vulnerability is not related to a package registry (NPM, PyPI, Go, Ruby) but rather a system-level Android application. The risk is to the Android supply chain, as a compromised PackageInstallerCN can be used to inject malicious packages into the device's software stack.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the device.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the vulnerability.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged account or app on the device.
• User Interaction (UI): None (N) – The vulnerability can be exploited without user interaction.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): High (H) – The attacker can install arbitrary packages, compromising system integrity.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is 6.1, the local attack vector and low privileges required make it a realistic threat for malware or malicious apps already present on a device.

Deep Dive & Mechanics

PackageInstallerCN is a system-level Android application responsible for handling package installation requests. When an app requests installation of another APK, the system typically invokes PackageInstallerCN to display a user consent dialog. The vulnerability lies in the permission check logic: the application fails to properly verify that the calling process has the necessary permissions to bypass user interaction.

In a normal flow, the android.permission.INSTALL_PACKAGES permission is required to install packages without user interaction. However, due to improper handling, a local attacker can craft an intent that triggers the installation process without the permission check being enforced. This allows the attacker to silently install any APK, including malware, without the user ever seeing a prompt.

The root cause is a missing or insufficient permission validation in the onActivityResult or startActivityForResult handler, where the application does not verify the caller's identity or permissions before proceeding with the installation.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the PackageInstallerActivity.java or similar file. The following is a conceptual representation:

Vulnerable Code (Pre-15.0.11.0):

// Vulnerable: No permission check before installation
public void onActivityResult(int requestCode, int resultCode, Intent data) {
    if (requestCode == INSTALL_REQUEST) {
        // Directly proceed with installation without checking caller permissions
        installPackage(data.getData());
    }
}

Patched Code (15.0.11.0+):

// Patched: Permission check added
public void onActivityResult(int requestCode, int resultCode, Intent data) {
    if (requestCode == INSTALL_REQUEST) {
        // Verify that the caller has the required permission
        if (checkCallingPermission(android.Manifest.permission.INSTALL_PACKAGES) == PackageManager.PERMISSION_GRANTED) {
            installPackage(data.getData());
        } else {
            // Deny installation and log the attempt
            Log.w(TAG, "Installation denied: caller lacks INSTALL_PACKAGES permission");
            setResult(RESULT_CANCELED);
            finish();
        }
    }
}

The patch adds a permission check using checkCallingPermission() to ensure only authorized callers can trigger silent installations.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A rooted Android device or emulator running a vulnerable version of PackageInstallerCN (< 15.0.11.0).
• A malicious APK to install (e.g., a reverse shell or spyware).
• ADB (Android Debug Bridge) access.

Exploitation Steps:

1. Prepare the Malicious APK: Create or obtain an APK that performs the desired action (e.g., exfiltrate data).
2. Craft the Exploit Intent: Use ADB or a malicious app to send an intent that triggers the installation without user interaction.

   adb shell am start -a android.intent.action.VIEW -d "file:///sdcard/malicious.apk" -n com.packageinstallercn/.PackageInstallerActivity --ez install_without_ui true
   

   Note: The exact intent action and extras may vary. The key is to bypass the UI prompt.
3. Execute the Exploit: Run the command. The APK will be installed silently.
4. Verify Installation: Check that the malicious app is installed and running.

   adb shell pm list packages | grep malicious
   

Blue Team

Detection Steps:

1. Monitor Package Installation Logs: Check logcat for unusual installation events without user interaction.

   adb logcat -s PackageInstallerCN
   

   Look for entries like Installation denied (if patched) or unexpected INSTALL_REQUEST calls.
2. Audit Installed Packages: Regularly compare the list of installed packages against a known good baseline.

   adb shell pm list packages > installed_packages.txt
   

3. Check for Suspicious Permissions: Look for apps that request INSTALL_PACKAGES permission but are not system apps.
4. Implement Behavioral Monitoring: Use an EDR solution to detect silent installation attempts.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – replace with actual hashes if available)
  • malicious.apk: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Names:
  • com.packageinstallercn
• Log Entries:
  • PackageInstallerCN: Installation request without UI
  • PackageInstallerCN: INSTALL_REQUEST received from untrusted caller
• Network Connections:
  • Outbound connections from the installed malicious app to a C2 server.
• File System Artifacts:
  • Unexpected APK files in /data/local/tmp/ or /sdcard/Download/.

Detection Engineering

YARA Rule

rule CVE_2025_20974_PackageInstallerCN {
    meta:
        description = "Detects vulnerable PackageInstallerCN APK files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-20974"
    strings:
        $vuln_class = "PackageInstallerActivity"
        $vuln_method = "onActivityResult"
        $vuln_install = "installPackage"
        $no_permission_check = "checkCallingPermission" xor
    condition:
        $vuln_class and $vuln_method and $vuln_install and not $no_permission_check
}

Sigma Rule

title: Silent Package Installation via PackageInstallerCN
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to install packages without user interaction on Android devices
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        - "PackageInstallerCN: Installation request without UI"
        - "PackageInstallerCN: INSTALL_REQUEST received from untrusted caller"
    condition: selection
falsepositives:
    - Legitimate system updates
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-20974 - Silent APK Download from PackageInstallerCN";
    flow:to_server,established;
    content:"|2f|apk|2f|download|2f|";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update PackageInstallerCN: Upgrade to version 15.0.11.0 or later as soon as it becomes available.
2. Restrict Installation Sources: Disable installation from unknown sources in Android settings.
3. Monitor for Exploitation: Review device logs for any signs of silent installation attempts.

Long-Term Mitigations:

1. Implement Application Control: Use a mobile device management (MDM) solution to whitelist approved apps.
2. Enforce Permission Audits: Regularly audit apps that hold the INSTALL_PACKAGES permission.
3. User Awareness: Educate users about the risks of granting installation permissions to untrusted apps.

Patch Status: UNKNOWN. The vendor has not released an official patch. Users should monitor the vendor's website for updates.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert