| 제목 | AirAsia AirAsia MOVE App 12.47.1 Path Traversal |
|---|
| 설명 | A vulnerability has been found in AirAsia MOVE App up to 12.47.1 on Android and classified as problematic. Affected by this issue is the function getRealPath of the class com.airasia.core.utils.RealPathUtil within the component Intent Handler (ACTION_SEND share intake). The manipulation of the argument _display_name (the copy destination filename, reported by the sending content provider) leads to path traversal. The attack can be launched by a co-installed local application and requires no authentication and no user interaction. The exploit has been demonstrated with a proof of concept.
The exported activity com.airasia.mobile.MainActivity2 (exported=true, launchMode=singleTask) declares an android.intent.action.SEND filter for image/*. On such an intent, o()/q() extract the EXTRA_STREAM URI and pass it to RealPathUtil.getRealPath(Context, Uri). getRealPath queries the URI, reads the _display_name column, and copies the input stream into new File(getCacheDir(), _display_name) with no basename strip, no canonical/NIO containment, and no allowlist. Because the sending application is the content provider, it controls the _display_name value. A traversal name such as ../files/x resolves to /data/data/com.airasia.mobile/cache/../files/x = /data/data/com.airasia.mobile/files/x, escaping the cache directory into sibling internal directories and yielding an attacker-controlled arbitrary file write inside the app sandbox (Dirty Stream). The write occurs as a side effect of path resolution, independent of how the returned path is later consumed.
This is not the receive_sharing_intent library lineage; the sink is AirAsia application code. cl.json.social.ShareIntent present in the app is react-native-share (outbound sharing) and is unrelated.
Reachability (warm path): MainActivity2.onNewIntent -> getAction() == "android.intent.action.SEND" -> o()/q() -> getParcelableExtra(EXTRA_STREAM) -> RealPathUtil.getRealPath. Cold-start routing to the sink is not confirmed.
Proof of concept: a companion app exposes an exported ContentProvider whose query() returns _display_name = "../files/aa_dirtystream_poc.txt" and whose openFile() serves attacker bytes, then issues an explicit-component ACTION_SEND (setClassName com.airasia.mobile / com.airasia.mobile.MainActivity2, type image/*, EXTRA_STREAM = the content URI). The victim writes the attacker bytes to /data/data/com.airasia.mobile/files/aa_dirtystream_poc.txt, verified via adb on a rooted device/emulator. Escalation lead: retargeting the payload at an internal file the app later loads (cached JS bundle, a .so, a database, or shared_prefs) turns the write primitive into behavior tampering or potential code execution.
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
CVSS 3.1: 6.8 Medium - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
CVSS 2.0: 3.6 - AV:L/AC:L/Au:N/C:N/I:P/A:P
Remediation: constrain the destination to a basename and enforce containment, e.g. reject unless out.getCanonicalPath().startsWith(getCacheDir().getCanonicalPath() + File.separator); or ignore the provider-supplied display name and derive the destination filename from a random UUID. |
|---|
| 원천 | ⚠️ https://docs.google.com/document/d/19qRCn6NWF2UE4urLXMXKgW555PHhnQiw/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true |
|---|
| 사용자 | Actuator (UID 67941) |
|---|
| 제출 | 2026. 07. 09. PM 02:12 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 01. PM 08:46 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397798 [AirAsia MOVE App 까지 12.47.1 켜짐 Android com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath _display_name 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|