{"id":113,"date":"2015-02-11T22:18:37","date_gmt":"2015-02-11T21:18:37","guid":{"rendered":"http:\/\/www.skateman.nl\/?p=113"},"modified":"2015-02-11T22:18:37","modified_gmt":"2015-02-11T21:18:37","slug":"remotely-install-and-launch-android-apps-from-the-play-store-vulnerability","status":"publish","type":"post","link":"https:\/\/www.skateman.nl\/index.php\/2015\/02\/11\/remotely-install-and-launch-android-apps-from-the-play-store-vulnerability\/","title":{"rendered":"Remotely install and launch Android apps from the Play Store Vulnerability"},"content":{"rendered":"

Lucky for me… i am using a Blackberry Passport!\u00a0<\/strong><\/p>\n

Vulnerability Summary<\/p>\n

Android Metasploit<\/a><\/p>\n

Due to a lack of complete coverage for X-Frame-Options (XFO) support on Google’s Play Store web application domain, a malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS (UXSS) targeting affected browsers, to remotely install and launch the main intent of an arbitrary Play Store provided Android package (APK).<\/p>\n

 <\/p>\n

Affected Platforms<\/p>\n

Many versions of Android 4.3 (Jelly Bean) and earlier ship with browsers with UXSS exposures, as discussed in this Rapid7 blog post. Users of these platforms may also have installed vulnerable aftermarket browsers, as discussed in this TrendLabs blog post. Of the vulnerable population, it is expected that many users are habitually signed into Google services, such as Gmail or YouTube. These mobile platforms are the the ones most at risk. Other browsers may also be affected.<\/p>\n

 <\/p>\n

Simplified Demonstration of the XFO Gap<\/p>\n

The following Javascript is sufficient to elicit a response from the play.google.com domain without an appropriate XFO header:<\/p>\n

via Metasploit: R7-2015-02: Google Play Store X-Fra… | SecurityStreet<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Lucky for me… i am using a Blackberry Passport!\u00a0 Vulnerability Summary Due to a lack of complete coverage for X-Frame-Options (XFO) support on Google’s Play Store web application domain, a malicious user can leverage either a Cross-Site Scripting (XSS) vulnerability in a particular area of the Google Play Store web application, or a Universal XSS […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[13,32,48,63,72],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry","category-security","tag-android","tag-flaw","tag-metasploit","tag-security","tag-vulnerability"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t