Read Time:1 Minute, 7 Second
Description
The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit:
Related Weaknesses
CWE-285
Consequences
Availability, Integrity: Unexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Varies by Context
Other applications, possibly untrusted, can launch the Activity.
Availability, Integrity: Unexpected State, Gain Privileges or Assume Identity, DoS: Crash, Exit, or Restart, DoS: Instability, Varies by Context
Other applications, possibly untrusted, can bind to the Service.
Confidentiality, Integrity: Read Application Data, Modify Application Data
Other applications, possibly untrusted, can read or modify the data that is offered by the Content Provider.
Potential Mitigations
Phase: Build and Compilation
Effectiveness:
Description:
If they do not need to be shared by other applications, explicitly mark components with android_exported=”false” in the application manifest.
Phase: Build and Compilation
Effectiveness:
Description:
If you only intend to use exported components between related apps under your control, use android_protectionLevel=”signature” in the xml manifest to restrict access to applications signed by you.
Phase: Build and Compilation, Architecture and Design
Effectiveness:
Description:
Limit Content Provider permissions (read/write) as appropriate.
Phase: Build and Compilation, Architecture and Design
Effectiveness:
Description:
Limit Content Provider permissions (read/write) as appropriate.
CVE References
