CVE-2021-41256: Inclusion of Functionality from Untrusted Control Sphere (CWE-829)
value: nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.
CWE description: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CVSS v3 base score: 7.1
Published: 2021-11-30T21:15Z
Repository: https://github.com/nextcloud/news-android
Language: Java
Files changed: News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java, News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java
Commit date: 2021-10-26 18:11:49 -0300
Commit message: fix GHSL-2021-1033

Signed-off-by: David Luhmer <david-dev@live.de>

Diff: diff --git a/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java b/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java
index 86e1e0d9..3cccfc91 100644
--- a/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java
+++ b/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/NewsReaderListActivity.java
@@ -979,12 +979,12 @@ public class NewsReaderListActivity extends PodcastFragmentActivity implements
             }
         }
     }
 
     private void ensureCorrectTheme(Intent data) {
-        String oldListLayout = data.getStringExtra(SettingsActivity.SP_FEED_LIST_LAYOUT);
-        String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT,"0");
+        String oldListLayout = data.getStringExtra(SettingsActivity.AI_FEED_LIST_LAYOUT);
+		String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
 
         if (ThemeChooser.themeRequiresRestartOfUI() || !newListLayout.equals(oldListLayout)) {
             NewsReaderListActivity.this.recreate();
         } else if (data.hasExtra(SettingsActivity.CACHE_CLEARED)) {
             resetUiAndStartSync();
diff --git a/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java b/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java
index 875c9f63..46e90198 100644
--- a/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java
+++ b/News-Android-App/src/main/java/de/luhmer/owncloudnewsreader/SettingsActivity.java
@@ -32,12 +32,10 @@ import androidx.appcompat.widget.Toolbar;
 
 import javax.inject.Inject;
 
 import de.luhmer.owncloudnewsreader.helper.ThemeChooser;
 
-import static de.luhmer.owncloudnewsreader.LoginDialogActivity.RESULT_LOGIN;
-
 /**
 * A {@link PreferenceActivity} that presents a set of application settings. On
 * handset devices, settings are presented as a single list. On tablets,
 * settings are split by category, with category headers shown to the left of
 * the list of settings.
@@ -82,11 +80,12 @@ public class SettingsActivity extends AppCompatActivity {
     public static final String SYNC_INTERVAL_IN_MINUTES_STRING_DEPRECATED = "SYNC_INTERVAL_IN_MINUTES_STRING";
 
     public static final String SP_APP_THEME = "sp_app_theme";
     public static final String CB_OLED_MODE = "cb_oled_mode";
 
-    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout";
+    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout"; // used for shared prefs
+    public static final String AI_FEED_LIST_LAYOUT = "ai_feed_list_layout"; // used for intents
     public static final String SP_FONT_SIZE = "sp_font_size";
 
     public static final String CACHE_CLEARED = "CACHE_CLEARED";
     public static final String SP_MAX_CACHE_SIZE = "sp_max_cache_size";
     public static final String SP_SORT_ORDER = "sp_sort_order";
@@ -146,13 +145,13 @@ public class SettingsActivity extends AppCompatActivity {
     }
 
     @Override
     protected void onStart() {
         super.onStart();
-        Intent intent = getIntent();
-        intent.putExtra(
-                SettingsActivity.SP_FEED_LIST_LAYOUT,
-                mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0")
-        );
-        setResult(RESULT_OK,intent);
+
+        // Fix GHSL-2021-1033
+        Intent intent = new Intent();
+        String feedListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
+        intent.putExtra(SettingsActivity.AI_FEED_LIST_LAYOUT, feedListLayout);
+        setResult(RESULT_OK, intent);
     }
 }

Vulnerable code:         String oldListLayout = data.getStringExtra(SettingsActivity.SP_FEED_LIST_LAYOUT);
        String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT,"0");
import static de.luhmer.owncloudnewsreader.LoginDialogActivity.RESULT_LOGIN;

    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout";
        Intent intent = getIntent();
        intent.putExtra(
                SettingsActivity.SP_FEED_LIST_LAYOUT,
                mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0")
        );
        setResult(RESULT_OK,intent);
Fixed code:         String oldListLayout = data.getStringExtra(SettingsActivity.AI_FEED_LIST_LAYOUT);
		String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout"; // used for shared prefs
    public static final String AI_FEED_LIST_LAYOUT = "ai_feed_list_layout"; // used for intents

        // Fix GHSL-2021-1033
        Intent intent = new Intent();
        String feedListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
        intent.putExtra(SettingsActivity.AI_FEED_LIST_LAYOUT, feedListLayout);
        setResult(RESULT_OK, intent);