Last updated
Last updated
The file provider_paths.xml
contains the following data:
You can use the Nuclei template provider-path.yaml
on a decompiled Android app to identify this misconfiguration.
Observe the provider has the root folder configuration that allows us to access home directory (which also includes /data
and /sdcard
directory).
This misconfiguration can be chained with other vulnerabilities like Intent Redirection
to steal sensitive data or Overwriting arbitrary files
to achieve arbitrary code execution by Overwriting native libraries.