1834
the internal state of the application, or trick a user into interacting with the victim application
while believing they are still interacting with the malicious application.
• If access to an exported Service is not restricted, any application may start and bind to the
Service. Depending on the exposed functionality, this may allow a malicious application to
perform unauthorized actions, gain access to sensitive information, or corrupt the internal
state of the application.
• If access to a Content Provider is not restricted to only the expected applications, then
malicious applications might be able to access the sensitive data. Note that in Android before
4.2, the Content Provider is automatically exported unless it has been explicitly declared as
NOT exported.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 285 Improper Authorization 684
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Mobile (Prevalence = Undetermined)
Background Details
There are three types of components that can be exported in an Android application.
• An Activity is an application component that provides a UI for users to interact with. A typical
application will have multiple Activity screens that perform different functions, such as a main
Activity screen and a separate settings Activity screen.
• A Service is an application component that is started by another component to execute an
operation in the background, even after the invoking component is terminated. Services do
not have a UI component visible to the user.
• The Content Provider mechanism can be used to share data with other applications or
internally within the same application.
Common Consequences
Scope Impact Likelihood
Availability
Integrity
Unexpected State
DoS: Crash, Exit, or Restart
DoS: Instability
Varies by Context
Other applications, possibly untrusted, can launch the
Activity.
Availability
Integrity
Unexpected State
Gain Privileges or Assume Identity
DoS: Crash, Exit, or Restart
DoS: Instability
Varies by Context
Other applications, possibly untrusted, can bind to the
Service.
Confidentiality Read Application Data
CWE Version 4.14
CWE-926: Improper Export of Android Application Components
CWE-926: Improper Export of Android Application Components