Security Audit

Our Web Application Pentest ( WAP) attempts to address the Owasp top 10 & SANS top 20 web application vulnerabilities and other exploitable loopholes of your web application . Along with it our WAP team also test web applications for Business logic flaws that can directly or indirectly effect the functioning of application.

Trainings

We are here to help you solve your biggest query- where and how to start? CDI has brought various courses in Ethical Hacking in Chandigarh where all you technology lovers will be given the much needed push to move forward and create a niche for yourself in the field. From Beginner to Expert level we have many kinds of training patterns.

India Nigeria Partner With Us Latest Events Articles
91-771045-0011
Call Us : +91-771045-0011
91-771045-0011

Google Play Store Vulnerable to XSS and UXSS Attacks

 Posted By: cdi / Feb 11, 2015 /  Google Play Store , UXSS , XSS , XFO , Remote Code Execution , Android , Google , Vulnerability

A Researcher at Rapid 7 has found a Critical Vulnerability in Google's Play Store Website, leveraging upon which, with the use of Cross-Site Scripting (XSS) in a particular area of website, or a Universal XSS (UXSS) targeting affected browsers, an attacker can perform Remote Code Execution attack, by remotely installing a malicious Android Package (APK). This is due to lack of complete coverage for X-Frame-Options (XFO) support on Google's Play Store web application domain.

According to the report, Android 4.3 (Jelly Bean) users and earlier shipped with browsers having UXSS vulnerabilities, are affected directly by this vulnerability.

Technical Details

Demonstration of XFO Gap

The following Javascript is sufficient to elicit a response from the play.google.com domain without an appropriate XFO header:

google play store vulnerable to xss and uxss

Metasploit module description

The Metasploit module combines two vulnerabilities to achieve remote code execution on affected Android devices. First, the module exploits a Universal Cross-Site Scripting (UXSS) vulnerability present in versions of Android's open source stock browser (the AOSP Browser) as well as some other browsers, prior to 4.4 (KitKat). Second, the Google Play store's web interface fails to enforce a X-Frame-Options: DENY header on some error pages, and therefore, can be targeted for script injection. As a result, this leads to remote code execution through Google Play's remote installation feature, as any application available on the Google Play store can be installed and launched on the user's device.

Mitigation

  • Use browser which is not susceptible to widely known UXSS vulnerabilities e.g. Google Chrome, Mozilla Firefox or the Dolphin Browser.
  • Don't be logged into a Google Account while using any browser

See more of Cyber Intelligence by logging in.
Connect with cyber security experts,Discover job opportunities,Online Training, Information Security Advisory and lot more.