提出 #851700: Textplus, Inc. Android https://play.google.com/store/apps/details?id=com.gogii.textplus 8.3.5 Improper Authorization

textPlus for Android (com.gogii.textplus) 8.3.5 exposes the activity
com.nextplus.android.activity.DialerActivity with android:exported="true" and no
permission guard. The activity forwards incoming intent extras into the
DialerFragment arguments bundle. DialerFragment.onCreate contains an auto-dial
branch that originates an outbound call when the arguments carry both
"com.nextplus.android.fragment.INTENT_ADDRESS_TO_CALL" and
"com.nextplus.android.fragment.INTENT_DISPLAY_STRING" and no "PHONE_NUMBER" key.
A non-JID address is classified as CallAddressType.PSTN and reaches the call
stack without any further user action.

Any installed application can therefore cause textPlus to place an arbitrary
outbound PSTN call. The calling application requires no Android permissions
(no CALL_PHONE, none) and no user interaction is needed.

Call path on the vulnerable branch:
DialerActivity (intent extras -> fragment arguments)
-> DialerFragment.onCreate
-> DialerFragment.makeCallWithPermissions(addr, PSTN, display)
-> CallingServiceImpl.makeCall(...)
-> LinphoneCallStack.makeCall(...)

InCallActivity and CallingServiceImpl are not exported, so DialerActivity is the
sole external attack surface. The manifest-declared tel:/sip: data path is not
the trigger: a tel: URI routes through the PHONE_NUMBER branch, which only
prefills the dialpad. The dangerous path is reached only through the two extras
above, which are not declared anywhere in the manifest.

Proof of concept (use a destination you control; the PSTN path consumes account
credits). Explicit component bypasses intent-filter matching:

adb shell am start -n com.gogii.textplus/com.nextplus.android.activity.DialerActivity --es "com.nextplus.android.fragment.INTENT_ADDRESS_TO_CALL" "[phone]" --es "com.nextplus.android.fragment.INTENT_DISPLAY_STRING" "poc"

Equivalent variant with an explicit action (same result; the action is
app-interpreted, not the system Telecom CALL, so no sender permission applies):

adb shell am start -a android.intent.action.CALL -n com.gogii.textplus/com.nextplus.android.activity.DialerActivity --es "com.nextplus.android.fragment.INTENT_ADDRESS_TO_CALL" "[phone]" --es "com.nextplus.android.fragment.INTENT_DISPLAY_STRING" "poc"

Observe origination in logcat: makeCall, LinphoneCallStack, CallingServiceImpl.

A zero-permission third-party app reproduces this with startActivity to the same
explicit component plus the two string extras (only a <queries> package-visibility
entry is needed on Android 11+, no uses-permission).

Impact: unauthorized outbound call origination driven by any local app without
permissions or user interaction. Calls are billed against the victim account and
present the victim textPlus number as caller ID, enabling toll abuse and
attacker-chosen caller-ID presentation through the victim identity.

Remediation: do not auto-originate calls from intent-supplied data; require an
explicit in-app user action before makeCallWithPermissions. Set
android:exported="false" on DialerActivity or gate it behind a signature-level
permission. If external tel:/sip: deep links must be supported, treat them as
prefill only and never forward arbitrary intent extras into fragment arguments.

• ソース: ⚠️ https://github.com/actuator/com.gogii.textplus
• ユーザー: Actuator (UID 67941)
• 送信: 2026年06月08日 17:48 (2 月 ago)
• モデレーション: 2026年08月03日 09:04 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 385527 [textPlus Text Message and Call App 迄 8.3.5 上 Android com.gogii.textplus DialerActivity Local Privilege Escalation]
• ポイント: 20