Module

Leaking Sensitive Information through an Implicit Intent

Summary

The Android application uses an implicit intent for transmitting sensitive data to other applications.

Description

Since an implicit intent does not specify a particular application to receive the data, any application can process the intent by using an Intent Filter for that intent. As such, when an implicit Intent is used with a method such as startActivity, startService, or sendBroadcast, it may be read by other applications on the device. This means that sensitive data in these Intents may be leaked.

There are two variations on the standard broadcast intent, ordered and sticky.

Ordered broadcast intents are delivered to a series of registered receivers in order of priority as declared by the Receivers. A malicious receiver can give itself a high priority and cause a denial of service by stopping the broadcast from propagating further down the chain. There is also the possibility of malicious data modification, as a receiver may also alter the data within the Intent before passing it on to the next receiver. The downstream components have no way of asserting that the data has not been altered earlier in the chain.
Sticky broadcast intents remain accessible after the initial broadcast. An old sticky intent will be broadcast again to any new receivers that register for it in the future, greatly increasing the chances of information exposure over time. Also, sticky broadcasts cannot be protected by permissions that may apply to other kinds of intents.

In addition, any broadcast intent may include a URI that references data that the receiving component does not normally have the privileges to access. The sender of the intent can include special privileges that grant the receiver read or write access to the specific URI included in the intent. A malicious receiver that intercepts this intent will also gain those privileges and be able to read or write the resource at the specified URI.

Risk

How Can It Happen? Unintentional use of an implicit intern can result in leaking sensitive information to other applications on the device.

Example

As indicated in CVE-2022-4903, a vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 7.0.71 is able to address this issue.

Example Code (Bad Code)

Below are a few examples that demonstrate this weakness.

Example 1. An application wants to create a user account in several trusted applications using one broadcast intent:
```
 Intent intent = new Intent();
 intent.setAction("com.example.CreateUser");
 intent.putExtra("Username", uname_string);
 intent.putExtra("Password", pw_string);
 sendBroadcast(intent);
```
This application assumes only the trusted applications will be listening for the action. However, a malicious application can register for this action and intercept the user’s login information, as below:
```
 IntentFilter filter = new IntentFilter("com.example.CreateUser");
 MyReceiver receiver = new MyReceiver();
 registerReceiver(receiver, filter);
```
Solution. When a broadcast contains sensitive information, create an allowlist of applications that can receive the action using the application’s manifest file, or programmatically send the intent to each individual intended receiver.
Example 2. This application interfaces with a web service that requires a separate user login. It creates a sticky intent, so that future trusted applications that also use the web service will know who the current user is:
```
 Intent intent = new Intent();
 intent.setAction("com.example.service.UserExists");
 intent.putExtra("Username", uname_string);
 sendStickyBroadcast(intent);
```
An attacker can register for this action and intercept the user’s login:
```
 IntentFilter filter = new IntentFilter("com.example.service.UserExists");
 MyReceiver receiver = new MyReceiver();
 registerReceiver(receiver, filter);
```
Solution. Sticky broadcasts can be read by any application at any time, and so should never contain sensitive information such as a username.

Example 3. This application is sending an ordered broadcast, asking other applications to open a URL:

 Intent intent = new Intent();
 intent.setAction("com.example.OpenURL");
 intent.putExtra("URL_TO_OPEN", url_string);
 sendOrderedBroadcastAsUser(intent);

Any application in the broadcast chain may alter the data within the intent. This malicious application is altering the URL to point to an attack site:

 public class CallReceiver extends BroadcastReceiver {
   @Override
   public void onReceive(Context context, Intent intent) {
     String Url = intent.getStringExtra(Intent.URL_TO_OPEN);
     attackURL = "www.example.com/attack?" + Url;
     setResultData(attackURL);
   }
 }

The final receiving application will then open the attack URL.

Solution. Where possible, send intents to specific trusted applications instead of using a broadcast chain.

Example 4. This application sends a special intent with a flag that allows the receiving application to read a data file for backup purposes.

 Intent intent = new Intent();
 intent.setAction("com.example.BackupUserData");
 intent.setData(file_uri);
 intent.addFlags(FLAG_GRANT_READ_URI_PERMISSION);
 sendBroadcast(intent);

Any malicious application can register to receive this intent, e.g.,

 public class CallReceiver extends BroadcastReceiver {
   @Override
     public void onReceive(Context context, Intent intent) {
     Uri userData = intent.getData();
     stealUserData(userData);
   }
 }

Because of the FLAG_GRANT_READ_URI_PERMISSION included with the intent, the malicious receiver code can read the user’s data.

Addressing Leaking Sensitive Information through an Implicit Intent

How would we address potential leaking sensitive information through an implicit intent in our code? Below are a few tips:

Use explicit intents. Explicit intents specify the target component by name, which means that only the specified component can receive the intent. This prevents other applications from intercepting the intent and accessing the sensitive data.
Use permissions. If you must use implicit intents, consider using custom permissions to restrict access to the intent. This way, only applications that have been granted the permission can receive the intent.
Avoid sending sensitive data in intents. If possible, avoid sending sensitive data in intents altogether. Instead, consider using other mechanisms such as content providers or secure storage to share sensitive data between applications.

The following examples contrast two ways of broadcasting Intents. In the “BAD” case, no “receiver permission” is specified. In the “GOOD” case, “receiver permission” or “receiver application” is specified.

// BAD: broadcast sensitive information to all listeners

public void sendBroadcast1(Context context, String token, String refreshToken) 
{
  Intent intent = new Intent();
  intent.setAction("com.example.custom_action");
  intent.putExtra("token", token);
  intent.putExtra("refreshToken", refreshToken);
  context.sendBroadcast(intent);
}

The following two examples address the weakness:

// GOOD: broadcast sensitive information only to those with permission

public void sendBroadcast2(Context context, String token, String refreshToken) 
{
  Intent intent = new Intent();
  intent.setAction("com.example.custom_action");
  intent.putExtra("token", token);
  intent.putExtra("refreshToken", refreshToken);
  context.sendBroadcast(intent, "com.example.user_permission"); // receiver permission
}

// GOOD: broadcast sensitive information to a specific application

public void sendBroadcast3(Context context, String token, String refreshToken) 
{
  Intent intent = new Intent();
  intent.setAction("com.example.custom_action");
  intent.setClassName("com.example2", "com.example2.UserInfoHandler"); // receiver application
  intent.putExtra("token", token);
  intent.putExtra("refreshToken", refreshToken);
  context.sendBroadcast(intent);
}

Acknowledgement

This page is inspired from the CodeQL project and CWE-927.