Insecure Permissions in Mirakel Allow Task Database Access

Executive Summary

This vulnerability involves insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 for Android. The ContentProvider is exported without proper permissions, allowing any app on the device to read and modify another user's task database without needing user interaction or runtime permissions.

Useful 0 Not Useful 0

Detection Guidance

Check for apps querying the MirakelInternalContentProvider URI content://de.azapps.mirakel.provider.internal/tasks. Use Android's package manager to inspect exported components in Mirakel v3.0. Look for unauthorized read access to task data like names, contents, or due dates.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive task data such as names, contents, due dates, list names, and sync states. They could also attempt to modify tasks, though the impact of modifications is unclear as changes may not be visible in the app.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, potentially violating GDPR (General Data Protection Regulation) and HIPAA (Health Insurance Portability and Accountability Act) if task data includes sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Uninstall Mirakel v3.0 or update to a patched version. If using the app, restrict its permissions or disable it until a fix is available. Set android:exported="false" in the app's manifest or add proper permissions to block unauthorized access.

Useful 0 Not Useful 0