Nextcloud · Report #145402
No permission set on Activities [Android App]
Informativestatus
3upvotes
20 Jun 2016disclosed
How it was found
Android app version: 1.0.0
Issue Details:
The following activities are exported and it does not have a permission set.
- com.owncloud.android.ui.activity.FileDisplayActivity
- com.owncloud.android.ui.activity.ReceiveExternalFilesActivity
- com.owncloud.android.authentication.AuthenticatorActivity
- com.owncloud.android.ui.activity.ShareActivity
This could allow any malicious application to initiate the above mentioned activities thus bypassing security checks or getting private information of any user.
Recommendation:
Set the permission for the above mentioned activities or either set android:exported=false (which allows the activities to be launched by only components of the same app or the same uid)