Arbitrary file overwrite vulnerabilities are, unfortunately, quite common in Android apps. Often the adversary can control some part of the path to partially or fully overwrite files in the file system of the application. The attacker thereby has the power to modify any file writable by the application. The attacker tries to abuse this control to escalate their privileges to code execution (with the privileges of the app). In the past, exploiting such vulnerabilities was extremely device dependent and required a lot of tinkering.

We explored this attack vector in depth and tried to assess if it can be exploited in a more generic way by attacking the Android runtime itself. In our Counterfeit Art paper we highlight the risk of this attack vector.

Our key idea is that we target data structures that are used by the Android runtime (ART) and modify it in ways that give us control over the instruction pointer to execute arbitrary code. Our exploitation technique targets the app image file that is writable by the application itself. We abuse this over privilege to modify the internal data structures and turn it into an exploitation primitive.

To demonstrate the feasibility of this modification we present two case studies for both a local and a remote attacker on common Android apps that are prone to file overwrite vulnerabilities.

Our goal of this research was to demonstrate the power of arbitrary file overwrites and to highlight the risk app developers are taking when not carefully vetting attacker-controlled inputs. The main credit goes to Rokhaya-Diamil Fall and Philipp Mao who have been closely working on this project.