Unvalidated implicit intent result leaks private files to a world-readable cache
Unvalidated implicit intent data lets a malicious app return an internal file:// URI, which AnkiDroid copies into a world-readable cache directory.
// tagged · 8 posts
#intent
OS command injection through an unsanitized path extra in DatabaseViewerActivity
OS command injection via an unsanitized path string extra in DatabaseViewerActivity.java allows arbitrary command execution when root explorer mode is enabled.
TCP1P CTF 2023 — Mobile Writeups
Mobile challenge solutions from TCP1P CTF: exported activity exploitation, implicit intent hijacking, and a WebView/JS interface/content provider chain.
File theft via missing intent validation and over-broad FileProvider paths
Theft of arbitrary files via lack of intent validation and insecure provider paths in TTFViewerActivity.kt.
Attacker-controlled bash scripts execute through the exported BashAssociation activity
Theft of arbitrary files via execution of attacker-controlled bash scripts through the exported BashAssociation activity.
Intent validation gap in TextViewerActivity opens arbitrary private files
Improper validation of intent data in TextViewerActivity allows a malicious app to open arbitrary files from Inure's private storage.
setResult misuse in a third-party welcome screen leaks a non-exported FileProvider
Theft of arbitrary files from a non-exported FileProvider via improper setResult() in a third-party welcome screen library.
InsecureShop — Android App Exploitation, pt. 2
Part 2: insecure broadcast receivers, implicit intent hijacking, intent redirection to protected components, and WebView file exfiltration.