Nextcloud · Report #1596459

Talk Android broadcast receiver is not protected by broadcastPermission allowing malicious apps to communicate

Validstatus

lowseverity

19upvotes

25 Dec 2022disclosed

Summary

Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-564v-3rfc-352m

How it was found

Summary:

Call to registerReceiver misses the broadcastPermission argument - no permissions will be checked for the broadcaster, which allows a malicious application to communicate with the broadcast receiver.

Supporting Material/References:

Screenshot Snyk report
references to fixes in other repos

https://github.com/alvinhkh/buseta/commit/6b791de8e3622ef157b065f9c82fcfd5a0e2302a?diff=split#diff-a75527f97c6732197964c1dbf30fd385L66

https://github.com/serso/android-messengerpp/commit/1528fdc2d3561bab192dfde9a84a737a26a19fce?diff=split#diff-7ff52f2abe79bd0a68d54916fe71aef2L92

https://github.com/irccloud/android/commit/857287d6d9da443b0ff667505d5bf4a383922784?diff=split#diff-f06bf5e27b9130d322139330f7f31997L40

Impact

Unsure, potentially interfere with call starts and audio/bluetooth setup

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original