No permission set on Activities [Android App]

Disclosed: 2016-06-20 15:10:52 By hax0rgb To nextcloud
Unknown
Vulnerability Details
Android app version: 1.0.0 Issue Details: ----------------- The following activities are exported and it does not have a permission set. 1) com.owncloud.android.ui.activity.FileDisplayActivity 2) com.owncloud.android.ui.activity.ReceiveExternalFilesActivity 3) com.owncloud.android.authentication.AuthenticatorActivity 4) com.owncloud.android.ui.activity.ShareActivity This could allow any malicious application to initiate the above mentioned activities thus bypassing security checks or getting private information of any user. Recommendation: ------------------------- Set the permission for the above mentioned activities or either set android:exported=false (which allows the activities to be launched by only components of the same app or the same uid)
Actions
View on HackerOne
Report Stats
  • Report ID: 145402
  • State: Closed
  • Substate: informative
  • Upvotes: 1
Share this report