Tag Archives: CWE- 926

CWE-926 – Improper Export of Android Application Components

Read Time:1 Minute, 7 Second

Description

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Modes of Introduction:

– Architecture and Design

Likelihood of Exploit:

 

Related Weaknesses

CWE-285

 

Consequences

Availability, Integrity: Unexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Varies by Context

Other applications, possibly untrusted, can launch the Activity.

Availability, Integrity: Unexpected State, Gain Privileges or Assume Identity, DoS: Crash, Exit, or Restart, DoS: Instability, Varies by Context

Other applications, possibly untrusted, can bind to the Service.

Confidentiality, Integrity: Read Application Data, Modify Application Data

Other applications, possibly untrusted, can read or modify the data that is offered by the Content Provider.

 

Potential Mitigations

Phase: Build and Compilation

Effectiveness:

Description: 

If they do not need to be shared by other applications, explicitly mark components with android_exported=”false” in the application manifest.

Phase: Build and Compilation

Effectiveness:

Description: 

If you only intend to use exported components between related apps under your control, use android_protectionLevel=”signature” in the xml manifest to restrict access to applications signed by you.

Phase: Build and Compilation, Architecture and Design

Effectiveness:

Description: 

Limit Content Provider permissions (read/write) as appropriate.

Phase: Build and Compilation, Architecture and Design

Effectiveness:

Description: 

Limit Content Provider permissions (read/write) as appropriate.

CVE References