Use of Implicit intent to send a broadcast with sensitive data

Search…

The com.insecureshop.AboutUsActivity contains the following code:
1
public final void onSendData(android.view.View view) {
2
        kotlin.jvm.internal.Intrinsics.checkParameterIsNotNull(view, "view");
3
        java.lang.String userName = com.insecureshop.util.Prefs.INSTANCE.getUsername();
4
        if (userName == null) {
5
            kotlin.jvm.internal.Intrinsics.throwNpe();
6
        }
7
        java.lang.String password = com.insecureshop.util.Prefs.INSTANCE.getPassword();
8
        if (password == null) {
9
            kotlin.jvm.internal.Intrinsics.throwNpe();
10
        }
11
        android.content.Intent intent = new android.content.Intent("com.insecureshop.action.BROADCAST");
12
        intent.putExtra("username", userName);
13
        intent.putExtra("password", password);
14
        sendBroadcast(intent);
15
        android.widget.TextView textView = (android.widget.TextView) _$_findCachedViewById(com.insecureshop.C0818R.id.textView);
16
        kotlin.jvm.internal.Intrinsics.checkExpressionValueIsNotNull(textView, "textView");
17
        textView.setText("InsecureShop is an intentionally designed vulnerable android app built in Kotlin.");
18
    }
19
}
Copied!
The above code defines an action com.insecureshop.action.BROADCAST and use implicit intent to send a broadcast containing username and password of the logged-in user.
Note (If you are exploiting this on Android version 7 and above):
On Android O, code like this no longer works the way that you expect:
1
sendBroadcast(new Intent("this.is.an.implicit.broadcast"));
Copied!
Normally, this broadcast would be received by all receivers that are registered for that custom action string. Even on O, two sets of receivers will still receive the broadcast:
Those whose apps have targetSdkVersion of 25 or lower
Those that were registered via registerReceiver() of some already-running process
To use Implicit Receivers in your application, you need to define them programmatically in your code, using registerReceiver().
Reference:
Interception of Android implicit intents
News, Techniques & Guides
Android Oreo Implicit and Explicit Broadcast Receiver - JournalDev
JournalDev

InsecureShop Challenges - Previous

Insecure use of FilePaths in FileProvider

Next - InsecureShop Challenges

Intercepting Implicit intent to load arbitrary URL

Last modified 9mo ago

Copy link

Contents

Reference: