| शीर्षक | achorein expo-share-intent 0.2.1 - 8.0.0 Path Traversal |
|---|
| विवरण | expo-share-intent (achorein) is a React Native / Expo module that receives files shared into a host app via ACTION_SEND / ACTION_SEND_MULTIPLE. The Android file-copy routine getDataColumn() in ExpoShareIntentModule.kt uses the shared content:// Uri's _display_name, returned by the SENDING app's ContentProvider, verbatim as the destination filename inside the host app cache directory:
targetFile = File(context.cacheDir, fileName)
The _display_name value is fully attacker-controlled and is not sanitized: there is no basename reduction (File(name).name), no canonical-path containment check, and no separator/".." rejection. A malicious application can return a _display_name such as "../databases/RKStorage" (or any value containing "../"), causing the streamed bytes to be copied outside cacheDir to an arbitrary path within the host application's private data directory (/data/data/<host.package>/...). This is the "Dirty Stream" pattern (CWE-22 / CWE-23).
Reachability: handleShareIntent() dispatches on the intent MIME type. Any type that is not "text/plain" and that the host's manifest filter admits (image/*, */*, application/*, or text/* via a non-plain subtype such as text/html), delivered via ACTION_SEND with an EXTRA_STREAM content Uri, reaches the copy routine. ACTION_SEND_MULTIPLE reaches the same sink per item. Both cold start (stored launch intent) and warm delivery (OnNewIntent) invoke the handler. The sending application requires no Android permissions.
Impact: attacker-controlled overwrite of files in the host application's private storage. Base impact is integrity (configuration, database and preference tampering, persistent denial of service). Overwriting an AsyncStorage database (databases/RKStorage) yields arbitrary control over the host app's stored state, including session/auth values, resulting in forced logout / DoS and possible auth-state manipulation. If the host application loads code from a writable path (for example an expo-updates / CodePush JS bundle, or an unpacked native library), the primitive can escalate to code execution.
Affected: all released versions 0.2.1 - 8.0.0 (latest). The vulnerable line is present at every release tag and at the current default-branch HEAD; no fixed version exists at time of submission.
Fix: reduce the provider-supplied name to its basename and require the resolved file to remain within cacheDir, otherwise fall back to the module's existing generated name (see pull request #221).
CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (Medium). Higher where a code-load-from-writable-path or a demonstrated session takeover is present.
Discovered and reported by Edward Warren, Actuator Security (actuator.sh). |
|---|
| स्रोत | ⚠️ https://github.com/achorein/expo-share-intent/pull/221 |
|---|
| उपयोगकर्ता | Actuator (UID 67941) |
|---|
| सबमिशन | 10/07/2026 04:50 PM (1 महीना पहले) |
|---|
| संयम | 24/08/2026 12:23 AM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394573 [achorein expo-share-intent तक 8.0.0 Android File Copy Routine ExpoShareIntentModule.kt getDataColumn _display_name निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|