How to Fix Vulnerabilities Issue in Android App with Ionic and Cordova

Question

I analyze an apk with MobSF and got a lot of vulnerabilities issues, but I don't know how to fix it.

ie

android.permission.REQUEST_INSTALL_PACKAGES dangerous
android.permission.WRITE_EXTERNAL_STORAGE dangerous
android.permission.CALL_PHONE dangerous
android.permission.WAKE_LOCK dangerous

Answer 1

These aren't vulnerabilities. They're called "dangerous" permissions because they allow you to do things that could compromise user privacy. Dangerous permissions require you to ask for permission at runtime, not just in the Manifest.

I'd remove any of those that you don't actually use. REQUEST_INSTALL_PACKAGES is particularly concerning, its very rare to need that. But if you actually need these to function, then there's no problem.

Answer 2

I resolved my issue using a hook in the build. This script remove the specific permissions:

var permissionsToRemove = [ "WRITE_EXTERNAL_STORAGE", "READ_EXTERNAL_STORAGE", "WAKE_LOCK", "REQUEST_INSTALL_PACKAGES" ];

module.exports = function(context) {
  const platformRoot = path.join(context.opts.projectRoot, 'platforms/android/app/src/main');
  const manifestFile = path.join(platformRoot, 'AndroidManifest.xml');

  if (fs.existsSync(manifestFile)) {
    fs.readFile(manifestFile, 'utf8', function (err, data) {
      if (err) {
        throw new Error('Unable to find AndroidManifest.xml: ' + err);
      }

      let result = data;

      for (var i=0; i<permissionsToRemove.length; i++) {
        result = result.replace( "<uses-permission android:name=\"android.permission." +       permissionsToRemove[i] + "\" />", "" );
      }
    });
  }
};