CVE-2010-4804
Android < 2.3.4 - Unauthorized SD Card Data Exposure via Crafted Content URIs
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2010-4804.
PoCs published by Thomas Cannon, thomascannon, Thomas Cannon, jduck, including Metasploit module auxiliary/gather/android_htmlfileprovider.
AI-analyzed exploit summary This exploit leverages a vulnerability in Android's content:// URI handling to disclose sensitive files via JavaScript executed in the context of the local device. It uses a multi-stage approach to exfiltrate file contents to a remote server.
Description
The Android browser in Android before 2.3.4 allows remote attackers to obtain SD card contents via crafted content:// URIs, related to (1) BrowserActivity.java and (2) BrowserSettings.java in com/android/browser/.
Exploits (3)
This exploit leverages a vulnerability in Android's content:// URI handling to disclose sensitive files via JavaScript executed in the context of the local device. It uses a multi-stage approach to exfiltrate file contents to a remote server.
This repository contains functional exploit code for CVE-2010-4804, an Android vulnerability that allows data theft via malicious web pages. The PoC uses a multi-stage attack to force download and execute JavaScript in the context of the local device, exfiltrating file contents to a remote server.
This Metasploit module exploits a cross-domain vulnerability in the Android web browser (CVE-2010-4804) to exfiltrate files from a vulnerable device. It uses JavaScript to read local files via XMLHttpRequest and sends the data to an attacker-controlled server.