CWE-926Improper Export of Android Application Components

Description

Common consequences· 3

• Availability / Integrity — Unexpected State, DoS: Crash, Exit, or Restart, DoS: Instability, Varies by Context
  Other applications, possibly untrusted, can launch the Activity.
• Availability / Integrity — Unexpected State, Gain Privileges or Assume Identity, DoS: Crash, Exit, or Restart, DoS: Instability, Varies by Context
  Other applications, possibly untrusted, can bind to the Service.
• Confidentiality / Integrity — Read Application Data, Modify Application Data
  Other applications, possibly untrusted, can read or modify the data that is offered by the Content Provider.

Potential mitigations· 4

• [Build and Compilation]If they do not need to be shared by other applications, explicitly mark components with android:exported="false" in the application manifest.
• [Build and Compilation]If you only intend to use exported components between related apps under your control, use android:protectionLevel="signature" in the xml manifest to restrict access to applications signed by you.
• [Build and Compilation, Architecture and Design]Limit Content Provider permissions (read/write) as appropriate.
• [Build and Compilation, Architecture and Design]Limit Content Provider permissions (read/write) as appropriate.

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.