Tasks.org App up to 12.7.0/13.0.0 on Android ShareLinkActivity.kt exposure of resource

Summaryinfo

A vulnerability classified as problematic was found in Tasks.org App up to 12.7.0/13.0.0 on Android. Affected by this issue is the function ShareLinkActivity.kt. The manipulation results in exposure of resource. This vulnerability was named CVE-2022-39349. The attack needs to be approached locally. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Tasks.org App up to 12.7.0/13.0.0 on Android (Android App Software). Affected is the function ShareLinkActivity.kt. The manipulation with an unknown input leads to a exposure of resource vulnerability. CWE is classifying the issue as CWE-668. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. This is going to have an impact on confidentiality. CVE summarizes:

The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` to handle "share" intents coming from other components in the same device and convert them to tasks. Those intents may contain arbitrary file paths as attachments, in which case the files pointed by those paths are copied in the app's external storage directory. Prior to versions 12.7.1 and 13.0.1, those paths were not validated, allowing a malicious or compromised application in the same device to force Tasks.org to copy files from its internal storage to its external storage directory, where they became accessible to any component with permission to read the external storage. This vulnerability can lead to sensitive information disclosure. All information in the user's notes and the app's preferences, including the encrypted credentials of CalDav integrations if enabled, could be accessed by third party applications installed on the same device. This issue was fixed in versions 12.7.1 and 13.0.1. There are no known workarounds.

The weakness was presented 10/26/2022 as GHSA-8x58-cg74-8jg8. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2022-39349 since 09/02/2022. There are known technical details, but no exploit is available.

Upgrading to version 12.7.1 or 13.0.1 eliminates this vulnerability. Applying the patch 23bf69d3f44b07e4bc62ea107f72103239f5d942 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Android App Software

Vendor

• Tasks.org

Name

• App

Version

• 12.0
• 12.1
• 12.2
• 12.3
• 12.4
• 12.5
• 12.6
• 12.7.0
• 13.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion