Need

Prevent unauthorized access to files exposed through Content Providers

Context

• Usage of Android development for mobile applications
• Ensuring secure access controls in Content Providers

Description

Non compliant code

        <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">

    <application
        android:allowBackup="true"
        android:theme="@style/AppTheme">

        <provider
            android:name=".InsecureContentProvider"
            android:authorities="com.example.app.provider"
            android:exported="true"
            android:grantUriPermissions="true" />

    </application>
</manifest>

        
        

The following AndroidManifest.xml configuration defines a ContentProvider that exposes application data without proper access restrictions.

- The attribute android:exported="true" allows any app on the device to access this Content Provider.
- The android:grantUriPermissions="true" attribute permits other apps to access sensitive files without additional restrictions.
- Without proper android:permission or android:readPermission attributes, any application can query and retrieve sensitive data.

If an attacker or a malicious app exploits this misconfiguration, they can access or modify sensitive files without authorization.

Steps

• Open the `AndroidManifest.xml` file.
• Identify any `` components.
• Set `android:exported="false"` unless external access is explicitly required.
• If external access is necessary, enforce permission controls using `android:permission`.
• Avoid using `android:grantUriPermissions="true"` unless strictly needed.

Compliant code

        <manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.app">

    <application
        android:allowBackup="true"
        android:theme="@style/AppTheme">

        <provider
            android:name=".SecureContentProvider"
            android:authorities="com.example.app.provider"
            android:exported="false"
            android:permission="com.example.app.SECURE_PERMISSION"
            android:grantUriPermissions="false" />

    </application>
</manifest>

        
        

The secure version restricts access to the Content Provider by:

- Setting android:exported="false" to prevent external access.
- Using android:permission="com.example.app.SECURE_PERMISSION" to enforce authentication and limit access to trusted applications.
- Explicitly defining android:grantUriPermissions="false" unless required.

These changes ensure that only authorized apps with explicit permissions can access the files exposed by this Content Provider.

References

• 075. Unauthorized access to files - APK Content Provider