# Two weeks of securing Samsung devices: Part 2

Multiple exported Samsung app components and unprotected content providers let any third-party app read/write arbitrary files, SMS/MMS, and contacts as system UIDs.

- Payout: unconfirmed
- Severity: high
- Program: Samsung
- Credited: Oversecured
- Disclosed: 2021-08-16
- CVE: CVE-2021-25426, CVE-2021-25410, CVE-2021-25413, CVE-2021-25414, CVE-2021-25440
- Write-up quality: 8/10
- Original: https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-two-weeks-of-securing-samsung-devices-part-2
- Tags: domain:mobile impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:android technique:chained technique:source-review vuln:access-control vuln:info-disclosure vuln:path-traversal

**Target:** Android preinstalled apps (Samsung Messages, CallBGProvider, Contacts, FactoryCameraFB, Android Settings)
**Root cause:** Exported activities/providers accept attacker-controlled URIs; CallBGProvider permission lacks protectionLevel (defaults to normal) and uses Uri.getLastPathSegment() which decodes %2F enabling path traversal; SetProfilePhotoActivity forwards attacker URIs with grant flags via implicit intent ClipData.
**Steps:**
1. Samsung Messages: build SmsViewerData with f25878w=content://com.samsung.android.messaging.ui.file/root-path/data/data/com.samsung.android.messaging/databases/message_content.db, launch SmsViewerActivity with xms_viewer_data extra, press Share message, then read saved file from /sdcard/Android/data/com.samsung.android.messaging/cache/ via MediaStore insert with _data path
2. CallBGProvider: declare uses-permission com.samsung.android.callbgprovider.PERMISSION, call content://com.samsung.android.callbgprovider.media method get_gradation_contents to create dirs, then openInputStream on content://com.samsung.android.callbgprovider.media/videos/..%2F..%2F..%2F..%2F..%2F..<encoded db path> to read mmssms.db
3. Contacts file theft: launch SetProfilePhotoActivity with shared_photo_uri=content://com.samsung.contacts.backup/data/data/com.samsung.android.app.contacts/shared_prefs/SamsungAnalyticsPrefs.xml and temp_photo_uri=content://oversecured.evil/?path=<output>; own provider writes file
4. Contacts provider access: launch SetProfilePhotoActivity with temp_photo_uri=/ and cropped_photo_uri=content://com.android.contacts/... ; intercept implicit CROP intent (priority 999) and query ClipData URI with granted read/write
5. FactoryCameraFB: launch CameraTestActivity with data=content://com.sec.internal.ims.rcs.fileprovider/root/data/system/users/0/settings_secure.xml and FLAG_GRANT_READ_URI_PERMISSION, testtype=NCAMTEST; read returned data URI
6. Android Settings: launch WifiDialogActivity, intercept android.settings.WIFI_DPP_ENROLLEE_QR_CODE_SCANNER implicit intent, setResult with fileprovider URI + FLAG_GRANT_READ_URI_PERMISSION to leak settings_secure.xml
**How found:** Oversecured scanner flagged file-theft taint in Samsung Messages; manual review of exported activities/providers and manifest permission declarations (missing protectionLevel) revealed URI injection and path traversal via decoded last path segment.
**Exploitation:** Malicious third-party app launches exported components with crafted URIs; target app opens attacker URI with its own privileges (system UID 1000/1001) and either copies file to shared cache or returns granted URI to attacker, who reads it via ContentResolver.
**Escalation:** Chained unsafe content providers (com.samsung.contacts.backup, com.sec.internal.ims.rcs.fileprovider) to reach files owned by system UID; FactoryCameraFB runs as android.uid.system enabling read of /data/system/users/0/settings_secure.xml.
**Insight:** Check AndroidManifest for <permission> without android:protectionLevel (defaults to normal, grantable by any app) and for providers using Uri.getLastPathSegment() which decodes %2F; also audit exported activities that forward attacker URIs into implicit intents with FLAG_GRANT_*_URI_PERMISSION via ClipData.