# Two weeks of securing Samsung devices: Part 1

Exported components in Samsung preinstalled apps let attackers install arbitrary apps, grant Device Admin, and read/write files as system UID.

- Payout: unconfirmed
- Severity: high
- Program: Samsung
- Credited: Oversecured
- Disclosed: 2021-06-10
- CVE: CVE-2021-25388, CVE-2021-25356, CVE-2021-25391, CVE-2021-25393, CVE-2021-25392, CVE-2021-25397, CVE-2021-25390
- Write-up quality: 7/10
- Original: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-1/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-1
- Tags: domain:mobile impact:data-leak impact:integrity impact:privesc kind:bounty platform:blog sev:high tech:android technique:chained technique:source-review vuln:access-control vuln:info-disclosure vuln:path-traversal

**Target:** Android preinstalled system apps (Knox Core, Managed Provisioning, Secure Folder, SecSettings, DeX System UI, TelephonyUI, PhotoTable)
**Root cause:** Exported services/receivers/activities accept attacker-controlled URIs, file paths, and intents without caller verification; Samsung's added requestId check skips verifyActionAndCaller.
**Steps:**
1. Knox Core: `startService` on exported `DualDARInitService` with `DUAL_DAR_IS_WPCOD=true` and bundle `dualdar-config-client-location=file://<attacker apk>`; app copies to world-readable `client_downloaded_knox_app.apk` and installs it
2. Managed Provisioning: `startActivity` on `PreProvisioningActivity` with `provisioningParams` (attacker APK URL + hash + DeviceAdmin component) and `com.samsung.knox.container.requestId=1` to skip `verifyActionAndCaller`
3. Secure Folder: `startActivityForResult` on `KnoxSettingCheckLockTypeActivity` with `FLAG_GRANT_READ/WRITE_URI_PERMISSION` and `ContactsContract.RawContacts.CONTENT_URI`; returned intent grants URI access
4. SecSettings: chain arbitrary content provider access with insecure FileProvider in `com.sec.imsservice` sharing `android.uid.system` to read/write files as UID 1000
5. DeX System UI: `sendBroadcast` `REQUEST_BACKUP_NOTIFICATION` with `SAVE_PATH=/sdcard` and `SESSION_KEY=not_empty`; read `notification_policy.xml`
6. TelephonyUI: `sendBroadcast` `DOWNLOAD_PHOTORING` with `photoring_uri=https://.../test.mp4` and `down_file=<mmssms.db path>` to overwrite SMS DB
7. PhotoTable: `startActivity` on `PermissionsRequestActivity` with `previous_intent` carrying `FLAG_GRANT_WRITE_URI_PERMISSION` to hijack SD card access
**How found:** Scanned preinstalled Samsung apps with Oversecured scanner; noticed app installed from SD card, traced exported DualDARInitService; compared Samsung-modified Managed Provisioning against AOSP to spot the requestId bypass; enumerated exported activities/receivers accepting URIs and file paths.
**Exploitation:** Malicious app on device sends crafted intents to exported Samsung components: installs attacker APK with Device Admin rights (and can wipe other apps), copies SMS/MMS DB to world-readable path then reads via MediaStore, overwrites telephony DB, and steals notification policy data.
**Escalation:** Chaining content-provider access with shared-UID FileProvider in SecSettings escalates to arbitrary file read/write as system UID 1000; Managed Provisioning grants Device Admin and app-removal capability.
**Insight:** Diff OEM-modified AOSP components against upstream to find removed authorization checks (e.g., a requestId extra that skips verifyActionAndCaller); also grep exported components for file-path/URI extras that get copied to world-readable dirs.