Tide Lock: Exploiting an Unsafe Android intent: URI Flow

Introduction

Tide Lock is an Android password-manager application used in a Mobile Hacking Lab exercise. The application stores website credentials and provides functionality for creating, editing, and viewing password entries.

The core security issue is an unsafe handling of untrusted URLs. A URL stored in a password entry is later parsed with Intent.parseUri() and passed to startActivity(). Because the application does not adequately constrain the resulting Intent at that point, an attacker-controlled URL can be used to reach an internal application component.