Insecure Permissions in Canvoki Allow Unauthorized Action Triggering

Executive Summary

This vulnerability involves insecure permissions in the ShortcutDispatchActivity component of the Voki Bot Android app. It allows unauthorized attackers to trigger another user's automated actions without permission or user interaction by supplying a trigger ID. The attack exploits an improperly exported Android component (CWE-926), enabling execution of privileged actions like launching activities or changing settings.

Useful 0 Not Useful 0

Detection Guidance

Check if the ShortcutDispatchActivity component in the Voki Bot app (net.canvoki.vokibot) is exported. Use the command: adb shell dumpsys package net.canvoki.vokibot | grep -A 10 "ShortcutDispatchActivity". If it shows android:exported="true", the component is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could execute your existing automations remotely, potentially performing privileged actions like changing system settings, launching activities, or broadcasting commands without your knowledge. This could lead to unauthorized changes to your device or data exposure if the automations include sensitive operations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict the ShortcutDispatchActivity component by setting android:exported="false" in the app's manifest. Alternatively, apply a custom permission to restrict access to the component until an official patch is released.

Useful 0 Not Useful 0