HexBrain

Nextcloud · Report #145402

No permission set on Activities [Android App]

Informativestatus
3upvotes
20 Jun 2016disclosed

How it was found

Android app version: 1.0.0

Issue Details:

The following activities are exported and it does not have a permission set.

  1. com.owncloud.android.ui.activity.FileDisplayActivity
  2. com.owncloud.android.ui.activity.ReceiveExternalFilesActivity
  3. com.owncloud.android.authentication.AuthenticatorActivity
  4. com.owncloud.android.ui.activity.ShareActivity

This could allow any malicious application to initiate the above mentioned activities thus bypassing security checks or getting private information of any user.

Recommendation:

Set the permission for the above mentioned activities or either set android:exported=false (which allows the activities to be launched by only components of the same app or the same uid)

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original