Theft of Arbitrary files from LocalStorage
The
ChooserActivity is exported and has defined several MIME types in the AndroidManifest.xml file.<activity
android:name=".ChooserActivity"
android:excludeFromRecents="true">
<intent-filter>
<action android:name="android.intent.action.VIEW" />
<category android:name="android.intent.category.DEFAULT" />
</intent-filter>
<intent-filter>
<action android:name="android.intent.action.SEND" />
<category android:name="android.intent.category.DEFAULT" />
<data android:mimeType="application/*" />
<data android:mimeType="audio/*" />
<data android:mimeType="image/*" />
<data android:mimeType="text/*" />
<data android:mimeType="video/*" />
</intent-filter>
<meta-data
android:name="android.service.chooser.chooser_target_service"
android:value=".ConversationChooserTargetService" />
</activity>
The
ChooserActivity contains the following code. The code takes the URI of the desired file via android.intent.extra.STREAM.var uri = intent.getParcelableExtra<Parcelable>("android.intent.extra.STREAM") as Uri
uri = Uri.fromFile(File(uri.toString()))
makeTempCopy(uri, this, getFilename(uri))
The
ChooserActivity is cloning the file which we got from android.intent.extra.STREAM in our sdcard within the folder named insecureapp .private fun makeTempCopy(fileUri: Uri, context: Context, original_filename: String?): Uri? {
try {
val out = Uri.fromFile(
File(
Environment.getExternalStorageDirectory().absolutePath + File.separator + "insecureapp",
original_filename
)
)
val inputStream: InputStream? = contentResolver.openInputStream(fileUri)
val outputStream: OutputStream? = contentResolver.openOutputStream(out)
val buffer = ByteArray(8192)
while (true) {
val len: Int? = inputStream?.read(buffer)
if (len != -1) {
len?.let { outputStream?.write(buffer, 0, it) }
}
}
return out
} catch (e: Exception) {
return null
}
}
This flaw allows any malicious third-party app on the device to steal any file from the InsecureShop app's localStorage and send it to sdcard (which is world readable/writeable).