Grant Permission Demo
What's Grant Permission Demo APK?
Grant Permission Demo is a app for Android, It's developed by Digiplex author.
First released on google play in 9 years ago and latest version released in 8 years ago.
This app has 0 download times on Google play and rated as 3.14 stars with 7 rated times.
This product is an app in Tools category. More infomartion of Grant Permission Demo on google play
# grantPermissionDemo
Source Code is available at : https://github.com/digiplexin/grantPermissionDemo
Access Contacts and Gallery without any permission in Android.
---------------------------------------------------
**Overview**
Android 4.4 and below can access system content providers that has grant uri enabled.
**Description**
An app can give one-time access to data protected by a permission to an application component using grant uri permission. A vulnerability exists where any app without the permission can provide access to system app's providers.
**Technical details.**
The android grant uri permission given through either Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_GRANT_WRITE_URI_PERMISSION. ResolverActivity is a system app with access to all content providers. So if ResolverActivity is made to launch then the other launching app can get permission even though the launcher activity does not have permission.
**Impact**
A number of system content providers use permission to protect data ( e.g contacts, gallery , mms data) but do provide grant uri permissions. All these content providers are vulnerable to this attack. This means that any malicious app can access users contacts and gallery without android permissions.
This vulnerability has already been addressed in Android 5.0 release.
Source Code is available at : https://github.com/digiplexin/grantPermissionDemo
Access Contacts and Gallery without any permission in Android.
---------------------------------------------------
**Overview**
Android 4.4 and below can access system content providers that has grant uri enabled.
**Description**
An app can give one-time access to data protected by a permission to an application component using grant uri permission. A vulnerability exists where any app without the permission can provide access to system app's providers.
**Technical details.**
The android grant uri permission given through either Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_GRANT_WRITE_URI_PERMISSION. ResolverActivity is a system app with access to all content providers. So if ResolverActivity is made to launch then the other launching app can get permission even though the launcher activity does not have permission.
**Impact**
A number of system content providers use permission to protect data ( e.g contacts, gallery , mms data) but do provide grant uri permissions. All these content providers are vulnerable to this attack. This means that any malicious app can access users contacts and gallery without android permissions.
This vulnerability has already been addressed in Android 5.0 release.
