CVE-2021-41256 (published 2021-11-30T21:15Z)

nextcloud news-android is an Android client for the Nextcloud news/feed reader app. In affected versions the Nextcloud News for Android app has a security issue by which a malicious application installed on the same device can send it an arbitrary Intent that gets reflected back, unintentionally giving read and write access to non-exported Content Providers in Nextcloud News for Android. Users should upgrade to version 0.9.9.63 or higher as soon as possible.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:P/I:P/A:N)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-829
cwe_name: Inclusion of Functionality from Untrusted Control Sphere
description: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
extended_description: 
            When including third-party functionality, such as a web widget, library, or other source of functionality, the product must effectively trust that functionality. Without sufficient protection mechanisms, the functionality could be malicious in nature (either by coming from an untrusted source, being spoofed, or being modified in transit from a trusted source). The functionality might also contain its own weaknesses, or grant access to additional functionality and state information that should be kept private to the base system, such as system state information, sensitive application data, or the DOM of a web application.
            This might lead to many different consequences depending on the included functionality, but some examples include injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, or open redirect to malware (CWE-601).
         
         

Fix information:
repo_url: https://github.com/nextcloud/news-android
commit_details: repo_url: https://github.com/nextcloud/news-android
author: David-Development
author_date: 2021-10-26 18:11:49-03:00
msg: fix GHSL-2021-1033

Signed-off-by: David Luhmer <david-dev@live.de>
repository: repo_url: https://github.com/nextcloud/news-android
repo_name: nextcloud/news-android
description: 📱🗞️ Android client for the Nextcloud news/feed reader app
repo_language: Java
owner: nextcloud
file_changes: filename: NewsReaderListActivity.java
change_type: ModificationType.MODIFY
diff: @@ -981,8 +981,8 @@ public class NewsReaderListActivity extends PodcastFragmentActivity implements
     }
 
     private void ensureCorrectTheme(Intent data) {
-        String oldListLayout = data.getStringExtra(SettingsActivity.SP_FEED_LIST_LAYOUT);
-        String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT,"0");
+        String oldListLayout = data.getStringExtra(SettingsActivity.AI_FEED_LIST_LAYOUT);
+		String newListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
 
         if (ThemeChooser.themeRequiresRestartOfUI() || !newListLayout.equals(oldListLayout)) {
             NewsReaderListActivity.this.recreate();

programming_language: Java
filename: SettingsActivity.java
change_type: ModificationType.MODIFY
diff: @@ -34,8 +34,6 @@ import javax.inject.Inject;
 
 import de.luhmer.owncloudnewsreader.helper.ThemeChooser;
 
-import static de.luhmer.owncloudnewsreader.LoginDialogActivity.RESULT_LOGIN;
-
 /**
 * A {@link PreferenceActivity} that presents a set of application settings. On
 * handset devices, settings are presented as a single list. On tablets,
@@ -84,7 +82,8 @@ public class SettingsActivity extends AppCompatActivity {
     public static final String SP_APP_THEME = "sp_app_theme";
     public static final String CB_OLED_MODE = "cb_oled_mode";
 
-    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout";
+    public static final String SP_FEED_LIST_LAYOUT = "sp_feed_list_layout"; // used for shared prefs
+    public static final String AI_FEED_LIST_LAYOUT = "ai_feed_list_layout"; // used for intents
     public static final String SP_FONT_SIZE = "sp_font_size";
 
     public static final String CACHE_CLEARED = "CACHE_CLEARED";
@@ -148,11 +147,11 @@ public class SettingsActivity extends AppCompatActivity {
     @Override
     protected void onStart() {
         super.onStart();
-        Intent intent = getIntent();
-        intent.putExtra(
-                SettingsActivity.SP_FEED_LIST_LAYOUT,
-                mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0")
-        );
-        setResult(RESULT_OK,intent);
+
+        // Fix GHSL-2021-1033
+        Intent intent = new Intent();
+        String feedListLayout = mPrefs.getString(SettingsActivity.SP_FEED_LIST_LAYOUT, "0");
+        intent.putExtra(SettingsActivity.AI_FEED_LIST_LAYOUT, feedListLayout);
+        setResult(RESULT_OK, intent);
     }
 }

programming_language: Java