| Título | BlueMail https://play.google.com/store/apps/details?id=me.bluemail.mail 2.2.305 (versionCode 43203). Path Traversal |
|---|
| Descrição | A vulnerability has been identified in Blix BlueMail 2.2.305 (versionCode 43203) on Android. The flaw resides in the bundled react-native-receive-sharing-intent component, specifically the file-copy routine FileDirectory.getDataColumn (and the fallback FileDirectory.getFileFromUri).
When the application receives a share, the destination filename for the imported file is read verbatim from the content provider _display_name column and concatenated onto getCacheDir() via new File(getCacheDir(), name) with no sanitization - no basename reduction, no canonical-path containment, no rejection of path separators or "../". A _display_name value beginning with "../" escapes the cache directory and writes into the application private data root (/data/user/0/me.bluemail.mail/).
The routine is reachable from the exported activity com.trtf.blue.MainActivity, which declares ACTION_SEND and ACTION_SEND_MULTIPLE intent filters with mimeType */*. A co-located malicious application sends a crafted ACTION_SEND intent whose EXTRA_STREAM points at an attacker-controlled content URI; the BlueMail share/compose flow then copies the streamed bytes to the traversed path. No authentication, account, or Android permission is required, and the write completes when the compose screen ingests the shared item, before any send or draft action.
Impact is arbitrary file write into the application private storage by an unprivileged local application (CWE-22), permitting overwrite of app-private files such as shared preferences, MMKV stores, and SQLite databases, and thereby tampering with application configuration and state. Remote code execution was assessed and not demonstrated: native libraries load from the read-only system library directory, the Hermes JavaScript bundle loads from read-only APK assets with no CodePush/Expo update channel, and dynamic dex loading is limited to verified Google Play Services components.
Root cause is in the third-party react-native-receive-sharing-intent library as integrated; the filename derived from _display_name (and from getLastPathSegment in the fallback path) must be sanitized before constructing the destination file. |
|---|
| Fonte | ⚠️ https://github.com/actuator/me.bluemail.mail |
|---|
| Utilizador | Actuator (UID 67941) |
|---|
| Submissão | 10/06/2026 14h08 (há 2 meses) |
|---|
| Moderação | 03/08/2026 13h25 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 385567 [Blix Email Blue Mail Calendar App 2.2.305 react-native-receive-sharing-intent _display_name Travessia de Diretório] |
|---|
| Pontos | 20 |
|---|