CWE-925: Improper Verification of Intent by Broadcast Receiver

Description

The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.

Certain types of Intents, identified by action string, can only be broadcast by the operating system itself, not by third-party applications. However, when an application registers to receive these implicit system intents, it is also registered to receive any explicit intents. While a malicious application cannot send an implicit system intent, it can send an explicit intent to the target application, which may assume that any received intent is a valid implicit system intent and not an explicit intent from another application. This may lead to unintended behavior.

Potential Impact

Demonstrative Examples

<manifest package="com.example.vulnerableApplication">
                        <application>
                           ...
                           
                           
                              <receiver android:name=".ShutdownReceiver"><intent-filter><action android:name="android.intent.action.ACTION_SHUTDOWN" /></intent-filter></receiver>
                           
                           
                           ...
                           
                           </application>
                     </manifest>

...
                     IntentFilter filter = new IntentFilter(Intent.ACTION_SHUTDOWN);BroadcastReceiver sReceiver = new ShutDownReceiver();registerReceiver(sReceiver, filter);
                     ...
                     
                     public class ShutdownReceiver extends BroadcastReceiver {@Overridepublic void onReceive(final Context context, final Intent intent) {mainActivity.saveLocalData();mainActivity.stopActivity();}}

window.location = examplescheme://method?parameter=value

Mitigations & Prevention

Detection Methods

• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses