Challenges
Search…
⌃K

Insecure use of FilePaths in FileProvider

The file provider_paths.xml contains the following data:
<?xml version="1.0" encoding="utf-8"?>
<paths xmlns:android="http://schemas.android.com/apk/res/android">
<root-path name="root" path="/"/>
</paths>
You can use the Nuclei template provider-path.yaml on a decompiled Android app to identify this misconfiguration.
echo /output_apktool/ | nuclei -t /file/android/provider-path.yaml
Observe the provider has the root folder configuration that allows us to access home directory (which also includes /data and /sdcard directory).
This misconfiguration can be chained with other vulnerabilities like Intent Redirection to steal sensitive data or Overwriting arbitrary files to achieve arbitrary code execution by Overwriting native libraries.