SECV-07-1403 - Android SQLi Api - SQL Injection on delete() method
Product description:
Android is a mobile operating system (OS) based on the Linux kernel that
is currently developed by Google. With a user interface based on direct
manipulation, Android is designed primarily for touchscreen mobile
devices such as smartphones and tablet computers, with specialized user
interfaces for televisions (Android TV), cars (Android Auto), and wrist
watches (Android Wear). The OS uses touch inputs that loosely correspond
to real-world actions, like swiping, tapping, pinching, and reverse
pinching to manipulate on-screen objects, and a virtual keyboard.
Despite being primarily designed for touchscreen input, it also has been
used in game consoles, digital cameras, and other electronics. As of
2011, Android has the largest installed base of any mobile OS and as of
2013, its devices also sell more than Windows, iOS, and Mac OS devices
combined. As of July 2013 the Google Play store has had over 1 million
Android apps published, and over 50 billion apps downloaded.[18] A
developer survey conducted in April–May 2013 found that 71% of mobile
developers develop for Android.[19] At Google I/O 2014, the company
revealed that there were over 1 billion active monthly Android users
(that have been active for 30 days), up from 538 million in June 2013.
CVE-ID: CVE-2014-4959
Affected versions: ALL
Vendor url: http://www.android.com
Vulnerability status: Not acknowledged. But Android Security will update
documentation.
Advisory url: http://www.secveritas.com/
Vulnerability details:
The Android SDK offers frameworks in order for developers develop their
applications in the most secure way possible. Specifically it offers an
SQLi API this api has all methods protected by the usage of prepared
statements. Nevertheless the method delete from the class SQLiteDatabase
is not protected.
Source code:
/frameworks/base/core/java/
public int delete(String table, String whereClause, String[] whereArgs) {
1492 acquireReference();
1493 try {
1494 SQLiteStatement statement = new SQLiteStatement(this,
"DELETE FROM " + table +
1495 (!TextUtils.isEmpty(
whereClause : ""), whereArgs);
1496 try {
1497 return statement.executeUpdateDelete(
1498 } finally {
1499 statement.close();
1500 }
1501 } finally {
1502 releaseReference();
1503 }
1504 }
Has it can be seen the argument whereClause is concatenated into the sql
query that is build and passed for execution. Only the whereArgs
argument is passed into the statment has an binded argument being
protected against sqlInjection. This is not documented on the API
documentation and only by reviewing the source code of the SQLi API
would and developer be aware of this fact.
Since the Android SDK in general and the SQLi API in particular have a
high security awareness and all other method use indeed the prepared
statements this fact may lead developers into a false sense of security.
Workaround:
Rewrite the delete method by extending the SQLiteDatabase class.
Timeline:
15th Jul - Disclosed to Android Security
22nd Jul - Android Security denied the vulnerability requested a PoC
23rd Jul - PoC provided source code + APK
24th Jul - Android security team stated that it was not an API
vulnerability. But admit that its not documented and that it will change
documentation.
24th Jul - Android was notified of the public disclosure of this advisory.
26th Jul - Public disclosure
Credits:
MS - SecVeritas.com
SECVeritas.com is a non-profit organization that aims to give their
members contribute the internet security.
The contents of this advisory are copyright(c) 2014 SECVeritas.com
You may distribute this advisory has a whole or in parts as long has you
maintain all the credits.
Product description:
Android is a mobile operating system (OS) based on the Linux kernel that
is currently developed by Google. With a user interface based on direct
manipulation, Android is designed primarily for touchscreen mobile
devices such as smartphones and tablet computers, with specialized user
interfaces for televisions (Android TV), cars (Android Auto), and wrist
watches (Android Wear). The OS uses touch inputs that loosely correspond
to real-world actions, like swiping, tapping, pinching, and reverse
pinching to manipulate on-screen objects, and a virtual keyboard.
Despite being primarily designed for touchscreen input, it also has been
used in game consoles, digital cameras, and other electronics. As of
2011, Android has the largest installed base of any mobile OS and as of
2013, its devices also sell more than Windows, iOS, and Mac OS devices
combined. As of July 2013 the Google Play store has had over 1 million
Android apps published, and over 50 billion apps downloaded.[18] A
developer survey conducted in April–May 2013 found that 71% of mobile
developers develop for Android.[19] At Google I/O 2014, the company
revealed that there were over 1 billion active monthly Android users
(that have been active for 30 days), up from 538 million in June 2013.
CVE-ID: CVE-2014-4959
Affected versions: ALL
Vendor url: http://www.android.com
Vulnerability status: Not acknowledged. But Android Security will update
documentation.
Advisory url: http://www.secveritas.com/
Vulnerability details:
The Android SDK offers frameworks in order for developers develop their
applications in the most secure way possible. Specifically it offers an
SQLi API this api has all methods protected by the usage of prepared
statements. Nevertheless the method delete from the class SQLiteDatabase
is not protected.
Source code:
/frameworks/base/core/java/
public int delete(String table, String whereClause, String[] whereArgs) {
1492 acquireReference();
1493 try {
1494 SQLiteStatement statement = new SQLiteStatement(this,
"DELETE FROM " + table +
1495 (!TextUtils.isEmpty(
whereClause : ""), whereArgs);
1496 try {
1497 return statement.executeUpdateDelete(
1498 } finally {
1499 statement.close();
1500 }
1501 } finally {
1502 releaseReference();
1503 }
1504 }
Has it can be seen the argument whereClause is concatenated into the sql
query that is build and passed for execution. Only the whereArgs
argument is passed into the statment has an binded argument being
protected against sqlInjection. This is not documented on the API
documentation and only by reviewing the source code of the SQLi API
would and developer be aware of this fact.
Since the Android SDK in general and the SQLi API in particular have a
high security awareness and all other method use indeed the prepared
statements this fact may lead developers into a false sense of security.
Workaround:
Rewrite the delete method by extending the SQLiteDatabase class.
Timeline:
15th Jul - Disclosed to Android Security
22nd Jul - Android Security denied the vulnerability requested a PoC
23rd Jul - PoC provided source code + APK
24th Jul - Android security team stated that it was not an API
vulnerability. But admit that its not documented and that it will change
documentation.
24th Jul - Android was notified of the public disclosure of this advisory.
26th Jul - Public disclosure
Credits:
MS - SecVeritas.com
SECVeritas.com is a non-profit organization that aims to give their
members contribute the internet security.
The contents of this advisory are copyright(c) 2014 SECVeritas.com
You may distribute this advisory has a whole or in parts as long has you
maintain all the credits.