8

I'm studying 'Directory traversal' attack in Android applications using this link

I understand the concept behind the vulnerability that the input needs to be sanitized properly before opening any file. I wanted to test the vulnerability, so I have some sample code that I wrote.

I have 2 apps (AppA and AppB), and my motive is to exploit the vulnerability in AppA's content provider openFile method. It is as follows:

@Nullable
@Override
public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {
    String path = Uri.parse(DETAILS_DIRECTORY + uri).getLastPathSegment();
    File file = new File(DETAILS_DIRECTORY, path);
    Log.v ("gaurav", "path : " + path);
    Log.v ("gaurav", "File exists: " + file.exists());

    return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY);
}

where DETAILS_DIRECTORY is :

private static final String DETAILS_DIRECTORY = "abc/efg/";

So, using directory traversal my motive is to access

/storage/sdcard/hello_world/logs

The code used for exploiting the vulnerability is (in AppB) :

String target = "content://com.android.AppA.Provider/friends/" +
            "%2E%2E%2F%2E%2E%2Fstorage%2Fsdcard%2Fhello_world%2Flogs";

ContentResolver cr = mContext.getContentResolver();
FileInputStream fis = null;
try {
      fis = (FileInputStream) cr.openInputStream(Uri.parse(target));
} catch (FileNotFoundException e) {
      e.printStackTrace();
}

What I understood from the above link is that it's indeed possible to access some file in some other directory (other than the default configured directory, which is DETAILS_DIRECTORY in this case). But if I run both apps, and try to attack, the final path I get is of the form /storage/sdcard/hello_world/logs which is indeed correct but file.exists() gives me false in the log, and it also causes FileNotFoundException for the obvious reasons. Is there any way I could go upto the root directory and access the desired path? I'd really appreciate some help regarding this.

UPDATE : It all boils down to the fact that when I have filepath as "/storage/sdcard/hello_world/logs", everything works fine, and all methods (canRead(), isFile(), exists()) return true, but when the file path is "/abc/efg/../../../storage/sdcard/hello_world/logs", methods return false, and file is not found. So I'm unable to understand how to use file API to access files which contain "../" in their path.

  • Is 'logs' a file or a directory? If it is a directory I would add a final slash (%2F) to see if that resolves your issues. – zedman9991 Dec 30 '15 at 15:28
  • @zedman9991 'logs' is a file. – gaurav jain Dec 30 '15 at 18:11
  • It looks like you need to add ..%2F.. to the start of your string first since you're trying to access the file within the context of the folder abc/efg/. Perhaps this: ..%2F..%2Fstorage%2Fsdcard%2Fhello_world%2Flogs. I am not sure, though, since it might be able to determine that it's supposed to be the root directory since it start with /. Perhaps give it a go? – d0nut Dec 30 '15 at 21:52
  • @iismathwizard Didn't help, still getting the same problem. – gaurav jain Jan 4 '16 at 10:36
  • Probably you have already checked this, but are you sure that 'logs' does not have an (hidden) extension, like logs.txt for example? – Michael Jan 4 '16 at 12:32
0
+50

Is abc/efg a valid directory? Please check. If it doesn't exists, it might not be able to resolve the path, and that's why those methods are returning false. Just make this small check. May be you could figure out the bug in the directory path somewhere. So I hope 'abc' and 'efg' are valid directories.

  • This is not an answer. If you'd like to request clarification from the author, please use the comment section. – Ohnana Jan 5 '16 at 13:14
  • Hi Archit, I tried the above, and strangely enough this worked. Thanks man! you saved my day, it was a really really silly mistake on my part. I changed the path to some valid one and it worked. – gaurav jain Jan 5 '16 at 13:20
  • @Ohnana From the answer, it seems more like a comment, I agree on that part, but this indeed worked when none of the above suggestions were working. So, I acknowledge it and giving him the bounty. – gaurav jain Jan 5 '16 at 13:21
  • @Ohnana: Since I just joined this community, I needed 15 reputations to make a comment, FYI. Of course it doesn't seems much of an answer, but it somehow worked for the author. :) – Archit Kapoor Jan 5 '16 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.