zakirkun Android Intent Redirection
Overview
Intent redirection occurs when an exported component receives an Intent from an untrusted source and forwards it to another component (potentially a private one). This allows attackers to:
- Access private Activities, Services, or ContentProviders
- Bypass permission requirements
- Escalate privileges
Common vulnerable pattern:
// Exported component receives intent with embedded redirect
Intent redirectIntent = (Intent) getIntent().getParcelableExtra("extra_intent");
startActivity(redirectIntent); // Attacker controls redirectIntent!
Remediation
- Validate Intent targets before forwarding
- Reject Intents with
FLAG_GRANT_READ_URI_PERMISSIONorFLAG_GRANT_WRITE_URI_PERMISSIONif not expected - Do not forward attacker-controlled Intents to sensitive components