I'm studying 'Directory traversal' attack in Android applications using this link

I understand the concept behind the vulnerability that the input needs to be sanitized properly before opening any file. I wanted to test the vulnerability, so I have some sample code that I wrote.

I have 2 apps (AppA and AppB), and my motive is to exploit the vulnerability in AppA's content provider openFile method. It is as follows:

public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {
    String path = Uri.parse(DETAILS_DIRECTORY + uri).getLastPathSegment();
    File file = new File(DETAILS_DIRECTORY, path);
    Log.v ("gaurav", "path : " + path);
    Log.v ("gaurav", "File exists: " + file.exists());

    return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY);


private static final String DETAILS_DIRECTORY = "abc/efg/";

So, using directory traversal my motive is to access


The code used for exploiting the vulnerability is (in AppB) :

String target = "content://com.android.AppA.Provider/friends/" +

ContentResolver cr = mContext.getContentResolver();
FileInputStream fis = null;
try {
      fis = (FileInputStream) cr.openInputStream(Uri.parse(target));
} catch (FileNotFoundException e) {

What I understood from the above link is that it's indeed possible to access some file in some other directory (other than the default configured directory, which is DETAILS_DIRECTORY in this case). But if I run both apps, and try to attack, the final path I get is of the form /storage/sdcard/hello_world/logs which is indeed correct but file.exists() gives me false in the log, and it also causes FileNotFoundException for the obvious reasons. Is there any way I could go upto the root directory and access the desired path? I'd really appreciate some help regarding this.

UPDATE : It all boils down to the fact that when I have filepath as "/storage/sdcard/hello_world/logs", everything works fine, and all methods (canRead(), isFile(), exists()) return true, but when the file path is "/abc/efg/../../../storage/sdcard/hello_world/logs", methods return false, and file is not found. So I'm unable to understand how to use file API to access files which contain "../" in their path.

  • Is 'logs' a file or a directory? If it is a directory I would add a final slash (%2F) to see if that resolves your issues.
    – zedman9991
    Dec 30, 2015 at 15:28
  • @zedman9991 'logs' is a file. Dec 30, 2015 at 18:11
  • It looks like you need to add ..%2F.. to the start of your string first since you're trying to access the file within the context of the folder abc/efg/. Perhaps this: ..%2F..%2Fstorage%2Fsdcard%2Fhello_world%2Flogs. I am not sure, though, since it might be able to determine that it's supposed to be the root directory since it start with /. Perhaps give it a go?
    – d0nut
    Dec 30, 2015 at 21:52
  • @iismathwizard Didn't help, still getting the same problem. Jan 4, 2016 at 10:36
  • Probably you have already checked this, but are you sure that 'logs' does not have an (hidden) extension, like logs.txt for example?
    – Michael
    Jan 4, 2016 at 12:32

1 Answer 1


Is abc/efg a valid directory? Please check. If it doesn't exists, it might not be able to resolve the path, and that's why those methods are returning false. Just make this small check. May be you could figure out the bug in the directory path somewhere. So I hope 'abc' and 'efg' are valid directories.

  • This is not an answer. If you'd like to request clarification from the author, please use the comment section.
    – Ohnana
    Jan 5, 2016 at 13:14
  • Hi Archit, I tried the above, and strangely enough this worked. Thanks man! you saved my day, it was a really really silly mistake on my part. I changed the path to some valid one and it worked. Jan 5, 2016 at 13:20
  • @Ohnana From the answer, it seems more like a comment, I agree on that part, but this indeed worked when none of the above suggestions were working. So, I acknowledge it and giving him the bounty. Jan 5, 2016 at 13:21
  • @Ohnana: Since I just joined this community, I needed 15 reputations to make a comment, FYI. Of course it doesn't seems much of an answer, but it somehow worked for the author. :)
    – Archit
    Jan 5, 2016 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .