Incorrect Access Control in Justson Agentweb-core Allows Sensitive Data Exposure

Executive Summary

This vulnerability is an Intent Redirection flaw in the AgentWeb library (versions 5.1.6-androidx and earlier). It allows malicious web pages to bypass Android's exported="false" restrictions by using specially crafted intent URLs (e.g., intent://...;component=...;end). This enables attackers to launch non-exported activities within the host application, inject arbitrary extras, and access internal app pages without proper authorization.

The flaw occurs because DefaultWebClient improperly parses and handles intent URLs, allowing web content to trigger unintended activities with attacker-controlled data. The vulnerability requires no user interaction beyond loading the page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your application uses AgentWeb library versions 5.1.6-androidx or earlier. Inspect the library version in your project dependencies or build files. If using Android Studio, check the External Libraries section for agentweb-core versions below 5.1.7-androidx.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to access sensitive internal app pages, steal data, or perform unauthorized actions by tricking users into visiting a malicious web page. It may enable phishing attacks, unauthorized app launches, or data theft if exploited.

Users of apps using vulnerable AgentWeb versions could have their data compromised or their devices manipulated without their knowledge. The attack is silent and requires no additional user interaction beyond page load.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating privacy requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data exposure, or failure to maintain data confidentiality, leading to compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to AgentWeb library version 5.1.7-androidx or later. Update your project dependencies to use the patched version from JitPack or Maven Central. Review your app's intent handling and component exports to ensure no non-exported activities can be launched via web intents.

Useful 0 Not Useful 0