No permission set on Activities [Android App]
Unknown
Vulnerability Details
Android app version: 1.0.0
Issue Details:
-----------------
The following activities are exported and it does not have a permission set.
1) com.owncloud.android.ui.activity.FileDisplayActivity
2) com.owncloud.android.ui.activity.ReceiveExternalFilesActivity
3) com.owncloud.android.authentication.AuthenticatorActivity
4) com.owncloud.android.ui.activity.ShareActivity
This could allow any malicious application to initiate the above mentioned activities thus bypassing security checks or getting private information of any user.
Recommendation:
-------------------------
Set the permission for the above mentioned activities or either set android:exported=false (which allows the activities to be launched by only components of the same app or the same uid)
Actions
View on HackerOneReport Stats
- Report ID: 145402
- State: Closed
- Substate: informative
- Upvotes: 1