Insecure Permissions in Simple Contacts Pro Allow Unauthorized Note Access

Executive Summary

This vulnerability involves insecure permissions in Simple Contacts Pro versionCode 107. Unauthorized attackers can read and write notes in another user's note database due to improper access controls.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves an improperly exported Android content provider in Simple Contacts Pro. To detect it, check if the app's provider `MyContactsContentProvider` is set to `android:exported="true"` in its manifest. Use Android Studio's APK analyzer or run `aapt dump xmltree <app.apk> AndroidManifest.xml` to inspect the manifest. If the provider lacks permission restrictions, the vulnerability exists.

Useful 0 Not Useful 0

Impact Analysis

Attackers could access or modify your private notes without permission. This could lead to data theft, unauthorized changes, or privacy breaches if sensitive information is stored in notes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing or allowing unauthorized modification of personal or sensitive data. Organizations may face compliance penalties if user data is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Simple Contacts Pro to the latest version if available. If no update exists, restrict access to the exposed provider by setting `android:exported="false"` in the manifest or adding permission restrictions. Disable the 'show private contacts' setting if enabled. Avoid installing untrusted apps that could exploit this.

Useful 0 Not Useful 0