CWE-927: Use of Implicit Intent for Sensitive Communication

Description:
The Android application uses an implicit intent for transmitting sensitive data to other applications.

Extended Description:
Since an implicit intent does not specify a particular application to receive the data, any application can process the intent by using an Intent Filter for that intent. This can allow untrusted applications to obtain sensitive data. There are two variations on the standard broadcast intent, ordered and sticky. 
             Ordered broadcast intents are delivered to a series of registered receivers in order of priority as declared by the Receivers. A malicious receiver can give itself a high priority and cause a denial of service by stopping the broadcast from propagating further down the chain. There is also the possibility of malicious data modification, as a receiver may also alter the data within the Intent before passing it on to the next receiver. The downstream components have no way of asserting that the data has not been altered earlier in the chain. 
             Sticky broadcast intents remain accessible after the initial broadcast. An old sticky intent will be broadcast ag

Affected languages: Not Language-Specific
Affected technologies: Mobile
Parent weaknesses: CWE-285, CWE-668

Consequences:
  - Confidentiality: Read Application Data
  - Integrity: Varies by Context

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] If the application only requires communication with its own components, then the destination is always known, and an explicit intent could be used.

Demonstrative examples:
This application wants to create a user account in several trusted applications using one broadcast intent:
This application assumes only the trusted applications will be listening for the action. A malicious application can register for this action and intercept the user's login information, as below:
Intent intent = new Intent(); intent.setAction("com.example.CreateUser"); intent.putExtra("Username", uname_string); intent.putExtra("Password", pw_string); sendBroadcast(intent);
IntentFilter filter = new IntentFilter("com.example.CreateUser"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter);

This application interfaces with a web service that requires a separate user login. It creates a sticky intent, so that future trusted applications that also use the web service will know who the current user is:
Sticky broadcasts can be read by any application at any time, and so should never contain sensitive information such as a username.
Intent intent = new Intent(); intent.setAction("com.example.service.UserExists"); intent.putExtra("Username", uname_string); sendStickyBroadcast(intent);
IntentFilter filter = new IntentFilter("com.example.service.UserExists"); MyReceiver receiver = new MyReceiver(); registerReceiver(receiver, filter);

Real-world examples:
  - CVE-2022-4903: An Android application does not use FLAG_IMMUTABLE when creating a PendingIntent.