Activity LoadLinkLaterActivity URL Redirection Vulnerability in FeedEx Handy News Reader

Executive Summary

This vulnerability is in the Handy Reading (FeedEx Fork) Android app version 116. It involves an exported activity called LoadLinkLaterActivity that can be triggered by another app on the same device. When activated, it forces the app to fetch a URL provided by the attacker without user interaction or permission checks. The attacker can insert this URL into the app's entries table and make HTTP requests to their controlled servers.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Handy Reading app (version 116) has the exported LoadLinkLaterActivity component. Use ADB commands like 'adb shell dumpsys package ru.yanus171.feedexfork | grep -i exported' to inspect exported activities. If LoadLinkLaterActivity is exported without proper permissions, the app is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to make your device fetch malicious URLs without your knowledge. This could lead to downloading malware, exposing sensitive data, or performing actions on your behalf. Since no user interaction or permissions are required, even apps with minimal permissions could trigger this attack.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration or malware downloads, violating GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information. Organizations using this app may face compliance violations if user data is compromised through this exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately uninstall or disable the Handy Reading app version 116. Avoid installing apps from untrusted sources. Monitor network traffic for unexpected HTTP requests from the app. Contact the app developer for an updated version with the activity restricted via android:exported='false' or proper permissions.

Useful 0 Not Useful 0