{"id":17066,"date":"2021-09-17T15:27:32","date_gmt":"2021-09-17T09:57:32","guid":{"rendered":"https:\/\/www.varutra.com\/?p=17066"},"modified":"2022-12-02T12:12:15","modified_gmt":"2022-12-02T06:42:15","slug":"all-you-need-to-know-about-android-webview-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/all-you-need-to-know-about-android-webview-vulnerabilities\/","title":{"rendered":"All you need to know about Android WebView Vulnerabilities"},"content":{"rendered":"


\nIn this blog we are going to understand about Android WebView Vulnerabilities.<\/p>\n

What is WebView ?<\/h3>\n

The WebView class in android allows you to load remote URLs and display the web page as a part of the activity layout. It does not work like a full-fledged browser, but it shows data on a web page inside the activity.<\/p>\n

For example, you might have seen it when we open links on social media apps like Twitter or Instagram, and the links open ups within the context of the application, but not as a separate browser.<\/p>\n

\"What<\/p>\n

Fig: 1.0 Webview<\/p>\n

Pre-requisites:<\/strong><\/h3>\n
    \n
  1. ADB – Android Debug Bridge<\/li>\n
  2. JADX \u2013 Android Decompiler<\/li>\n
  3. Android Emulator<\/li>\n<\/ol>\n

    For the testing purpose, we are using a vulnerable android application called\u00a0Vulnerable WebView Application<\/a>.<\/p>\n

    \"Android<\/p>\n

    Fig: 2.0 Vulnerable WebView App<\/p>\n

    In the below screenshot we can see that the application is loading the bugcrowd page in WebView.<\/p>\n

    \"bugcrowd<\/p>\n

    Fig: 3.0 bugcrowd page in WebView<\/p>\n

     <\/p>\n

    How to look for WebView Vulnerabilities in Application?<\/h3>\n

    WebViews are a part of the activities of the android application. We first need to decompile the app and go through the application\u2019s activities to check for any vulnerability. We will use the JADX tool to decompile the application. Once the application is decompiled, we will look at the android manifest file to get an overview of the structure of the application and its components. To find the vulnerable WebView we will look at the exported components of the android application.<\/p>\n

    The application has some components that are exported. The MainActivity is exported via intent filters whereas the SupportWebView and RegistrationWebView are explicitly exported.<\/p>\n

     <\/p>\n

    \"Support<\/p>\n

    Fig: 4.0<\/p>\n

    Go to the Registration WebView activity, and see that webview and its client have been imported into the activity. At the bottom, you can see that webview has been used.<\/p>\n

    \"Registration<\/p>\n

    Fig: 5.0<\/p>\n

    To spot the vulnerability, you see the code is loading the URL, and it is using a string sent through the intent to load the URL. The third-party applications can be easily exploited by this behavior as intent can be easily sent to the component with a URL string attached to it. Then, the target application will accept this because the component is exported. i.e., third-party applications have access to it.<\/p>\n

    <\/h3>\n

    Exploitation of WebView Vulnerabilities:<\/h3>\n

    For the exploitation, an emulator is used on which the vulnerable application is installed. Now, ADB will be sending an intent to the component. A malicious webpage will be open inside the context of the application. This intent is provided by the attacker.<\/p>\n

    adb shell am start -n component name –es string “example.com”<\/p>\n

    ADB shell starts a unique shell on a device. AM stands for activity manager, and android is instructing that it is to manage all the components in the application start.<\/p>\n