# Hunting Android Application Bugs Using Android Studio.

Android apps enforced admin permissions only client-side via a hardcoded PermissionChecker value, letting a low-privileged user access admin customer data and add records.

- Payout: $3,300
- Severity: high
- Program: -
- Credited: Tarek Mohammed
- Disclosed: 2020-07-24
- Write-up quality: 6/10
- Original: https://co0nan.gitbook.io/wirteups/
- Library page: https://bugbountylibrary.com/r/blog%3Aco0nan-gitbook-io-wirteups
- Tags: domain:mobile impact:ato impact:pii-leak impact:privesc kind:bounty platform:blog sev:high tech:android technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Android merchant apps (customer/engine) and their backend APIs
**Root cause:** Authorization was enforced only in the mobile client: PermissionChecker.checkAccessPermission compared a hardcoded accessPermissionName (e.g. _ACCESS) against the user's permission list, with no server-side validation of the privileged action.
**Steps:**
1. Pull APK: `adb pull /data/app/com.company.customer/base.apk`
2. Decompile with MobSF, open Java source in Android Studio attached to debug APK
3. Set breakpoints in PermissionChecker.checkAccessPermission; observe accessPermissionName = `_ACCESS`
4. Query `/v3/merchant/{ID}/permissions` as admin to find a permission the low role holds, e.g. `MANUAL_ENTRY_ALLOWED`
5. In debugger, change accessPermissionName from `_ACCESS` to `MANUAL_ENTRY_ALLOWED` and continue
6. Repeat at each permission check (view, Add Customer, save) to access admin screens and create records
**How found:** Recalled a 2017 backend authz bug and hypothesized mobile apps hit the same APIs; after hitting a 'no permission' message, decompiled and used logcat/debugger to locate PermissionChecker and inspect runtime variables.
**Exploitation:** Attacker logs in as a low-privileged merchant user on an emulator, runs the app under Android Studio debugger, and rewrites the runtime permission string to a permission their role already holds, bypassing the client gate to view customer PII and add customer records via the same backend APIs.
**Escalation:** Second finding: MerchantService.doNotifyLocalProperites logged the owner passcode to logcat; reading it via Android Studio allowed entering the owner passcode and taking over the merchant account.
**Insight:** When a mobile app shows a client-side 'no permission' dialog, attach a debugger and inspect the permission string variable at the check; swapping it for any permission your low role legitimately holds often passes the gate because the server never re-validates.