Insecure Permissions in NoNonsense Notes Allow Note Tampering

Executive Summary

This vulnerability involves insecure permissions in the NotificationHelper component of NoNonsense Notes version 72600. Two exported broadcast receivers lack authentication checks, allowing any installed app to modify note completion status or timestamps by sending broadcasts with a note ID. The issue stems from improper export of Android components without permission restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if NoNonsense Notes version 72600 is installed on your Android device. Look for two exported, permission-less broadcast receivers that accept note IDs and modify note states without authentication. Use Android debugging tools like 'adb shell dumpsys package com.nononsenseapps.notepad' to inspect exported components.

Useful 0 Not Useful 0

Impact Analysis

An attacker could alter your notes' completion status or timestamps without your knowledge. While they cannot read or delete notes, unauthorized changes could disrupt your task management or to-do lists. The attack requires only another app on your device, no special permissions.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update NoNonsense Notes to the latest version if available. If no update exists, uninstall the app or restrict access to its broadcast receivers by setting android:exported='false' or adding an android:permission attribute. Avoid installing untrusted apps that could exploit this vulnerability.

Useful 0 Not Useful 0