vendor:
Android
by:
Imre Rad / Search-Lab Ltd.
4.6
CVSS
MEDIUM
Path Traversal
22
CWE
Product Name: Android
Affected Version From: Android 4.0.4
Affected Version To: Android 5 (Lollipop)
Patch Exists: YES
Related CWE: CVE-2014-7951
CPE: o:google:android
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Android 4.0.4
2014
ADB backup archive path traversal file overwrite
Using adb one can create a backup of his/her Android device and store it on the PC. The backup archive is based on the tar file format. By modifying tar headers to contain ../../ like patterns it is possible to overwrite files owned by the system user on writeable partitions. An example pathname in the tar header: apps/com.android.settings/sp/../../../../data/system/evil.txt Tar header checksum must be corrected of course. When restoring the modified archive the BackupManagerService overwrites the resolved file name, since file name is not sanitized.
Mitigation:
Bugfix in the version control: https://android.googlesource.com/platform/frameworks/base/+/7bc601d!/#F0 Android 5 (Lollipop) and newer versions are not affected (due to the official bugfix linked above). Additional conditions for exploiting on pre-Lollipop systems: - Partition of the desination file must be mounted as writeable (eg. /system won't work, but /data does) - It is not possible to overwrite files owned by root, since the process doing the restore is running as the same user as the package itself and Android packages cannot run. - It is not possible to overwrite files owned by system user since AOSP 4.3 due to Id6a0cb4c113c2e4a8c4605252cffa41bea22d8a3, a new hardening was introduced '... ignoring non-agent system package'. (If the operating system is custom and there is a system package available with a full backup agent specified explicitly, then that custom Android 4.3 and 4.4 might be affected too.) Pre 4.3 AOSP systems are affected without further conditions: it is possible to overwrite files owned by the system user or any other packages installed on the system.
