Request for feedback on Android exported ContentProvider lab finding

[kmerghlani]

Hi everyone,

I’m building my mobile/API security evidence discipline and would appreciate quick feedback on one Android lab finding.

Finding:
Exported Android ContentProvider allows external insertion of notes.

Context:
This is from DIVA, an intentionally vulnerable Android lab app. No real client app, production app, or user data is involved.

Evidence chain:

• Manifest/provider recon identified the exported provider.
• Smali review showed insert/update/delete and writable database behavior.
• ADB content-provider insert was performed.
• Follow-up query showed the inserted test row.

What I’m trying to validate:

1. Is this correctly classified?
2. Is B+ the right evidence grade?
3. Is the only missing A-grade proof a separate attacker-app PoC?
4. Is the business impact clear enough?
5. What would a senior mobile tester add before using this as a sample finding?

I prepared a small review packet with the finding card, evidence manifest, command outputs, and smali excerpt. I can share the relevant text here or a sanitized ZIP if appropriate.

Thanks,
Khaled

[sushi2k]

Hi @kmerghlani.

The MASTG discussions are intended for questions and contributions related to the project itself, around the test cases, techniques, weaknesses etc. We're not able to review individual findings, validate "evidence grade", or advise on how a specific result should be presented in a report. That falls outside the project's scope.

The MASTG covers already ContentProvider security in detail (it is currently re-worked and will be updated soon), the weakness, applicable tests and the resources you need are already there. How you apply them to a specific engagement is the tester's call.

Closing this as out of scope for project discussions.