Definition of Directory Traversal
Directory traversal is a form of HTTP exploit in which a hacker uses the software on a Web server to access data in a directory other than the server's root directory. If the attempt is successful, the hacker can view restricted files or even execute commands on the server.
How Directory Traversal impacts the Android O.S
Directory Traversal within Android, allows attackers to perpetrate a path traversal attack in the context of a user application and read/write files inside internal storage.
Android Directory Traversal attack Example
ES File Explorer v184.108.40.206 - Path Traversal Vulnerability
Product & Service Introduction:
ES File Explorer is a free all-in-one including a file manager & application & tasks, support for online storage spaces (Dropbox, Google Drive, SkyDrive, Box.net, Sugarsync, Yandex, Amazon S3),
Technical Details & Description:
A Path Traveral web vulnerability has been discovered in the official in the official ES File Explorer v220.127.116.11 mobile android web-application. The security vulnerability allows a remote attacker to unauthorized request local files and device system paths to compromise the application or device.
The vulnerability is located in the
content://com.estrongs.files/system/ path request with the context. The vulnerability can be exploited by
local or remote attackers without user interaction. The attacker needs to replace the sdcard path request in the com.estrongs.files/system with a
malicious path request like ./etc/passwd ./etc/hosts and continues the request. The attack vector is located on the application-side of the service
and the request is http.
Although I understand what Directory Traversal is and how Directory Traversal can take place. I don't know what factors makes a selection of Android code vulnerable to such an attack.