640
}
Example 3:
This application sends a special intent with a flag that allows the receiving application to read a
data file for backup purposes.
Example Language: Java (Bad)
Intent intent = new Intent();
intent.setAction("com.example.BackupUserData");
intent.setData(file_uri);
intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);
sendBroadcast(intent);
Example Language: Java (Attack)
public class CallReceiver extends BroadcastReceiver {
@Override
public void onReceive(Context context, Intent intent) {
Uri userData = intent.getData();
stealUserData(userData);
}
}
Any malicious application can register to receive this intent. Because of the
FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code
can read the user's data.
Observed Examples
Reference Description
CVE-1999-1193 untrusted user placed in unix "wheel" group
https://www.cve.org/CVERecord?id=CVE-1999-1193
CVE-2005-2741 Product allows users to grant themselves certain rights that can be used to
escalate privileges.
https://www.cve.org/CVERecord?id=CVE-2005-2741
CVE-2005-2496 Product uses group ID of a user instead of the group, causing it to run with
different privileges. This is resultant from some other unknown issue.
https://www.cve.org/CVERecord?id=CVE-2005-2496
CVE-2004-0274 Product mistakenly assigns a particular status to an entity, leading to increased
privileges.
https://www.cve.org/CVERecord?id=CVE-2004-0274
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 723 OWASP Top Ten 2004 Category A2 - Broken Access
Control
711 2335
MemberOf 859 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 16 - Platform Security (SEC)
844 2369
MemberOf 884 CWE Cross-section 884 2567
MemberOf 901 SFP Primary Cluster: Privilege 888 2386
CWE Version 4.14
CWE-267: Privilege Defined With Unsafe Actions
CWE-267: Privilege Defined With Unsafe Actions