== Why is this an issue?

Intent redirection vulnerabilities occur when an application publicly exposes a
feature that uses an externally provided intent to start a new component.

In that case, an application running on the same device as the affected one can
launch the exposed, vulnerable component and provide it with a specially crafted
intent. Depending on the application's configuration and logic, this intent will
be used in the context of the vulnerable application, which poses a security
threat.


=== What is the potential impact?

An affected component that forwards a malicious externally provided intent does so using the vulnerable application's context. In particular, the new component is created with the same permissions as the application and without limitations on what feature can be reached.

Therefore, an attacker exploiting an intent redirection vulnerability could
manage to access a private application's components. Depending on the features
privately exposed, this can lead to further exploitations, sensitive data
disclosure, or even persistent code execution.

==== Information disclosure

An attacker can use the affected feature as a gateway to access other components
of the vulnerable application, even if they are not exported. This includes
features that handle sensitive information.

Therefore, by crafting a malicious intent and submitting it to the vulnerable
redirecting component, an attacker can retrieve most data exposed by private
features. This affects the confidentiality of information that is not
protected by an additional security mechanism, such as an encryption algorithm.

==== Attack surface increase

Because the attacker can access most components of the application, they can
identify and exploit other vulnerabilities that would be present in them. The
actual impact depends on the nested vulnerability. Exploitation probability
depends on the in-depth security level of the application.

==== Privilege escalation

If the vulnerable application has privileges on the underlying devices, an
attacker exploiting the redirection issue might take advantage of them. For
example by crafting a malicious intent action, the attacker could be able to
pass phone calls on behalf of the entitled application.

This can lead to various attack scenarios depending on the exploited
permissions.

==== Persistent code execution

A lot of applications rely on dynamic code loading to implement a variety of
features, such as:

* Minor feature updates.
* Application package size reduction.
* DRM or other code protection features.

When a component exposes a dynamic code loading feature, an attacker could use
it during the redirection's exploitation to deploy malicious code into the
application. The component can be located in the application itself or one of
its dependencies.

Such an attack would compromise the application execution environment entirely
and lead to multiple security threats. The malicious code could:

* Intercept and exfiltrate all data used in the application.
* Steal authentication credentials to third-party services.
* Change the application's behavior to serve another malicious purpose 
  (phishing, ransoming, etc) 

Note that in most cases, the deployed malware can persist application or
hosting device restarts.


// How to fix it section

include::./how-to-fix-it/android.adoc[]

== Resources

include::../common/resources/docs.adoc[]

include::../common/resources/standards.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Change this code to not perform arbitrary intent redirection.


endif::env-github,rspecator-view[]