Document Picker -> Trusted-File Confusion

← Improper Platform Usage

document_picker_trusted_file_confusion   MEDIUM

Description

The app assumes a file returned by the system document / file picker (or a security-scoped URL) is trustworthy simply because the OS handed it over, and feeds its path / type / contents into a sensitive sink with no re-validation, so an attacker-controlled document provider supplies a malicious path/type that the app trusts - the opposite direction to an over-broad FileProvider (Apple Document Picker / security-scoped URL trust-confusion class).

How it works

The app assumes a file returned by the system document or file picker (or a security-scoped URL) is trustworthy just because the OS handed it over. It feeds the declared type, name, or path into a sensitive sink with no re-validation, so a document that claims to be a harmless “text/plain” file but whose real bytes are an executable script is parsed or executed, and its declared path is followed into a privileged location. The picked bytes are written to a real temp file and the magic bytes are re-read off disk; the secure path re-validates that real content type and confines the canonical path under the import sandbox.

How to exercise it. DVMA is the harness - open this module from the home index and tap the demo action. The screen ships the malicious input and simulates the attacker (e.g. the companion app, crafted intent, or scanned payload) in-process, and the evidence panel prints the proof. The Tools (optional) and Attack inputs below are only needed to reproduce the exploit end-to-end on a real device.

Exploit steps

1. Set up. Build DVMA with a flavor that enables the Improper Platform Usage category (e.g. --dart-define-from-file=config/flavors/dev.json) and run on an iOS simulator / a device you control. The demo needs no external tooling; for the optional on-device reproduction the relevant tools are: frida, objection, r2frida, ipsw, class-dump, Hopper, r2ghidra, Ghidra.
2. Locate the target. From the home index, open Document Picker -> Trusted-File Confusion (document_picker_trusted_file_confusion). The How it works section above describes this module’s specific weakness; the screen states the intended-secure behavior and exposes the vulnerable action.
3. Exploit. From an attacker context (a crafted custom-URL-scheme / Universal Link, a malicious document provider / share extension, or a Shortcut), send the untrusted input to the handler and confirm the app performs the unsafe action (navigation, file/URL access, privileged operation) with no validation.
4. Observe the evidence. Trigger the vulnerable action and read the evidence panel - it prints the concrete proof (leaked value, accepted replay, executed payload, or unauthorized result).
5. Contrast with the secure path. Run the module’s secure/hardened action (where provided) and confirm the same attack is rejected - this is what a correct implementation should do.

Tools (optional)

• frida
• objection
• r2frida
• ipsw
• class-dump
• Hopper
• r2ghidra
• Ghidra

Real-world references

Concrete public disclosures that match this vulnerability class:

• Apple: App extensions (File Provider / Document Picker trust boundaries)