CWE-926, Improper Export of Android Application Components, covers an Android app that exports a component for other apps but does not restrict which apps can launch it or reach its data. It is a common finding in mobile app reviews.
How it happens
What goes wrong depends on the component, as MITRE spells out:
- An exported Activity that is not restricted can be launched by any app. A malicious app may reach sensitive information, change internal state, or trick the user into interacting with your app while thinking they are still in the malicious one.
- An exported Service can be started and bound by any app. That can mean unauthorized actions, information exposure or corrupted state.
- A Content Provider that is not restricted can let malicious apps read its data. MITRE notes that on Android before 4.2, a Content Provider is exported automatically unless explicitly declared as not exported.
<!-- Exposed to every app on the device -->
<service android:name=".SyncService" android:exported="true" />
<!-- Private to your app -->
<service android:name=".SyncService" android:exported="false" />
What an attacker gains
The consequences vary: other untrusted apps can launch the Activity, bind to the Service, or read and modify what the Content Provider offers. MITRE lists availability, integrity and confidentiality impacts, including crashes, instability, unexpected state and gaining privileges.
How to find it
MITRE notes SAST can find some instances by tracing data flow. A quick manual check: open the manifest and list every component with exported set to true, and every Content Provider that does not explicitly say it is not exported.
How to fix it
From the MITRE mitigations:
- If a component does not need to be shared, mark it with android:exported="false" in the manifest.
- If you only share components among your own apps, use android:protectionLevel="signature" so only apps signed by you can access them.
- Limit Content Provider read and write permissions as appropriate.
Quick check
What does protectionLevel signature do?
It restricts access to applications signed with your certificate.
Why did older Android versions make Content Providers riskier?
Before Android 4.2 they were exported automatically unless declared not exported.
