| 제목 | Polaris Office Corp https://play.google.com/store/apps/details?id=com.infraware.office.link 9.9.19 Path Traversal |
|---|
| 설명 | Polaris Office for Android is affected by a path traversal vulnerability in its document intake path. The launcher activity com.infraware.service.ActLauncher is exported and declares an intent filter that accepts content and file URIs of any MIME type under the VIEW, EDIT, PICK, RUN and SEARCH actions, so it can be invoked by any other application on the device. When such an intent is processed, the routine com.infraware.service.m.n.a(android.content.Intent) reads the file name from the sending ContentProvider by querying the _display_name column (or a filename column) and concatenates that value, without sanitization, onto a fixed base directory under the application's external storage, then copies the sender's input stream to the resulting file. The file name is never reduced to its base component and no canonical containment check is applied, so a _display_name containing ../ sequences traverses out of the intended directory. A malicious application can thereby write fully attacker-controlled content to an attacker-chosen path inside the Polaris external storage tree, including the application's own app-specific external directory that the document viewer subsequently reads and trusts. Exploitation requires only local inter-process access and needs no user interaction and no additional permissions. This was confirmed on-device: an unprivileged application exporting a ContentProvider that returns a traversal string as _display_name causes a marker file to be written under the Polaris process UID, outside the intended cache directory. |
|---|
| 원천 | ⚠️ https://docs.google.com/document/d/1HtHrkT1NRX7ZY8uyu_C0F2Scp7wWDcor/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true |
|---|
| 사용자 | Actuator (UID 67941) |
|---|
| 제출 | 2026. 07. 11. PM 04:56 (4 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 12. AM 10:21 (3 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416857 [Polaris Office App 9.9.19 켜짐 Android Document Intake com.infraware.service.m.n.a _display_name 디렉토리 순회] |
|---|
| 포인트들 | 20 |
|---|