Challenges
  • Introduction
  • InsecureShop Challenges
    • Hardcoded Credentials
    • Insufficient URL Validation
    • Weak Host Validation
    • Arbitrary Code Execution
    • Intent Redirection (Access to Protected Components)
    • Unprotected Data URIs
    • Theft of Arbitrary files from LocalStorage
    • Using Components with Known Vulnerabilities
    • Insecure Broadcast Receiver
    • AWS Cognito Misconfiguration
    • Insecure use of FilePaths in FileProvider
    • Use of Implicit intent to send a broadcast with sensitive data
    • Intercepting Implicit intent to load arbitrary URL
    • Insecure Implementation of SetResult in exported Activity
    • Insecure Content Provider
    • Lack of SSL Certificate Validation
    • Insecure Webview Properties Enabled
    • Insecure Data Storage
    • Insecure Logging
Powered by GitBook
On this page

Was this helpful?

Last updated 3 years ago

The file provider_paths.xml contains the following data:

You can use the Nuclei template provider-path.yaml on a decompiled Android app to identify this misconfiguration.

Observe the provider has the root folder configuration that allows us to access home directory (which also includes /data and /sdcard directory).

This misconfiguration can be chained with other vulnerabilities like Intent Redirection to steal sensitive data or Overwriting arbitrary files to achieve arbitrary code execution by Overwriting native libraries.

<?xml version="1.0" encoding="utf-8"?>
<paths xmlns:android="http://schemas.android.com/apk/res/android">
    <root-path name="root" path="/"/>
</paths>
echo /output_apktool/ | nuclei -t /file/android/provider-path.yaml
PreviousAWS Cognito MisconfigurationNextUse of Implicit intent to send a broadcast with sensitive data
  1. InsecureShop Challenges

Insecure use of FilePaths in FileProvider