Description

Detects insecure Android content provider configurations that could allow unauthorized access to application data. When content providers are exported with URI permissions but without proper custom permissions, other applications can potentially access sensitive data.

Detection Strategy

• Check if content provider has android:exported attribute missing

• Check if content provider has android:exported="true"

• When exported is true, verify if android:grantUriPermissions="true"

• For providers with granted URI permissions, verify if android:permission attribute references a custom permission

• Report vulnerability if provider grants URI permissions but lacks custom permission controls

Vulnerable code example

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.vulnerable">
    
    <application>
        <!-- Vulnerable: Provider exposed without proper permissions -->
        <provider
            android:name=".ExampleProvider"...

✅ Secure code example

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.vulnerable">

    <!-- Define custom permission to protect the provider -->
    <permission
        android:name="${applicationId}.PROVIDER_PERMISSION"
        android:protectionLevel="signature" />...