Page History

...

Yet another approach is to use the LocalBroadcastManager class. Using this class the intent broadcast it never going outside of the current process. According to the Android API Reference, LocalBroadcastManager has a number of advantages over Context.sendBroadcast(Intent):

• You know that the data you are broadcasting won't leave your app, so don't need to worry about leaking private data.
• It is not possible for other applications to send these broadcasts to your app, so you don't need to worry about having security holes they can exploit.
• It is more efficient than sending a global broadcast through the system.

Noncompliant Code Example

...

public class ServerService extends Service {
  // ...
  private void d() {
    // ...
    Intent v1 = new Intent();
    v1.setAction("com.sample.action.server_running");
    v1.putExtra("local_ip", v0.h);
    v1.putExtra("port", v0.i);
    v1.putExtra("code", v0.g);
    v1.putExtra("connected", v0.s);
    v1.putExtra("pwd_predefined", v0.r);
    if (!TextUtils.isEmpty(v0.t)) {
      v1.putExtra("connected_usr", v0.t);
    }
  }
  this.sendBroadcast(v1);
}

...

final class MyReceiver extends BroadcastReceiver {
  public final void onReceive(Context context, Intent intent) {
    if (intent != null && intent.getAction() != null) {
      String s = intent.getAction();
      if (s.equals("com.sample.action.server_running") {
        String ip = intent.getStringExtra("local_ip");
        String pwd = intent.getStringExtra("code");
        String port = intent.getIntExtra("port", 8888);
        boolean status = intent.getBooleanExtra("connected", false);
      }
    }
  }
}

Proof of Concept

An attacker can implement a broadcast receiver to receive the implicit intent sent by the vulnerable application:

...