1838
This application wants to create a user account in several trusted applications using one broadcast
intent:
Example Language: Java (Bad)
Intent intent = new Intent();
intent.setAction("com.example.CreateUser");
intent.putExtra("Username", uname_string);
intent.putExtra("Password", pw_string);
sendBroadcast(intent);
This application assumes only the trusted applications will be listening for the action. A malicious
application can register for this action and intercept the user's login information, as below:
Example Language: Java (Attack)
IntentFilter filter = new IntentFilter("com.example.CreateUser");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
When a broadcast contains sensitive information, create an allowlist of applications that can
receive the action using the application's manifest file, or programmatically send the intent to each
individual intended receiver.
Example 2:
This application interfaces with a web service that requires a separate user login. It creates a sticky
intent, so that future trusted applications that also use the web service will know who the current
user is:
Example Language: Java (Bad)
Intent intent = new Intent();
intent.setAction("com.example.service.UserExists");
intent.putExtra("Username", uname_string);
sendStickyBroadcast(intent);
Example Language: Java (Attack)
IntentFilter filter = new IntentFilter("com.example.service.UserExists");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);
Sticky broadcasts can be read by any application at any time, and so should never contain
sensitive information such as a username.
Example 3:
This application is sending an ordered broadcast, asking other applications to open a URL:
Example Language: Java (Bad)
Intent intent = new Intent();
intent.setAction("com.example.OpenURL");
intent.putExtra("URL_TO_OPEN", url_string);
sendOrderedBroadcastAsUser(intent);
Any application in the broadcast chain may alter the data within the intent. This malicious
application is altering the URL to point to an attack site:
Example Language: Java (Attack)
public class CallReceiver extends BroadcastReceiver {
@Override
CWE Version 4.14
CWE-927: Use of Implicit Intent for Sensitive Communication
CWE-927: Use of Implicit Intent for Sensitive Communication