Inure CVE-2023-5321 Missing Authorization Arbitrary File Read

Vulnerability Key Information Vulnerability Overview CVE: CVE-2023-5321 Vulnerability Type: CWE-862: Missing Authorization Severity: Medium (5.1) Description In the Build89 version of the Inure application, a vulnerability was discovered: an export activity (.activities.association.TextViewerActivity) accepts intent data via file scheme and "text/" MIME type, and opens the associated file using the provided URI data string. The check function is poorly designed, allowing malicious applications to bypass validation by sending an intent with a file path pointing to the Inure app's private directory (/data/data/app.simple.inure), resulting in the Inure app opening arbitrary files. Impact The app's private directory and its contained files should not be accessible to other applications on the device. The reported vulnerability indicates that malicious third-party applications can exploit this flaw to open or view any file within the Inure app's private directory, due to insufficient validation of the received intent data string. Occurrence File: TextViewerActivity.kt#L31 Problematic Code: Attackers can still bypass validation by using "data//data". References Related Huntr Report Fix Status Fixer: Hamza Rizwan Fixed Version**: build94

Goal Reached Thanks to every supporter — we hit 100%!

Inure CVE-2023-5321 Missing Authorization Arbitrary File Read