Falhas do tipo CWE-927

18 resultados

Uso de Intent implícita para comunicação sensível

Em aplicações Android, usar Intent implícita (sem especificar explicitamente qual app receberá) para transmitir dados sensíveis permite que qualquer aplicação registrada para aquele tipo de ação intercepte a mensagem. O receptor não é validado, criando risco de vazamento de dados ou execução maliciosa.

Exemplo

Um app bancário envia dados de autenticação via Intent implícita para 'com.example.PROCESS_PAYMENT' esperando que seu próprio serviço responda, mas um malware no device também registrado para essa ação intercepta as credenciais antes do destino legítimo.

Como mitigar

Use Intent explícita: especifique o pacote e componente exato destinatário via setComponent() ou setPackage(). Para dados realmente sensíveis, prefira comunicação local (SharedPreferences cifrada, banco de dados privado) ou canais seguros entre componentes da mesma app.

CVE-2022-4903MEDIUMCodenameOne implicit intent for sensitive communicationEPSS 0.6%CVE-2023-47889HIGHThe Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers. TheEPSS 0.3%CVE-2022-33734MEDIUMSensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connecEPSS 0.2%CVE-2022-33733MEDIUMSensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connectioEPSS 0.2%CVE-2022-36830MEDIUMPendingIntent hijacking vulnerability in cancelAlarmManager in Charm by Samsung prior to version 1.2.3 allows local attackers to access fileEPSS 0.2%CVE-2022-36829MEDIUMPendingIntent hijacking vulnerability in releaseAlarm in Charm by Samsung prior to version 1.2.3 allows local attackers to access files withEPSS 0.2%CVE-2023-41828MEDIUM An implicit intent export vulnerability was reported in the Motorola Phone application, that could allow unauthorized access to a non-exporEPSS 0.2%CVE-2023-41826MEDIUMA PendingIntent hijacking vulnerability in Motorola Device Help (Genie) application that could allow local attackers to access files or inteEPSS 0.2%CVE-2024-3108MEDIUM An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquirEPSS 0.2%CVE-2023-41820MEDIUM An implicit intent vulnerability was reported in the Motorola Ready For application that could allow a local attacker to read information aEPSS 0.1%CVE-2024-3480LOWAn Implicit intent vulnerability was reported in the Motorola framework that could allow an attacker to read telephony-related data.EPSS 0.1%CVE-2023-41817LOWAn improper export vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read unauthorizedEPSS 0.1%CVE-2023-41824LOW An implicit intent vulnerability was reported in the Motorola Phone Calls application that could allow a local attacker to read the callingEPSS 0.1%CVE-2023-31014MEDIUMNVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device canEPSS 0.1%CVE-2023-44127LOWCall management - Implicit activity intents disclose contact details and phone numbersEPSS 0.1%CVE-2023-44122MEDIUMLockScreenSettings - Theft arbitrary files with system privilegeEPSS 0.1%CVE-2023-44124MEDIUMScreen recording - Theft of arbitrary files with system privilegeEPSS 0.1%CVE-2025-48558HIGHIn multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit inteEPSS 0.1%