| 标题 | MapQuest MapQuest - com.mapquest.android.ace 10.16.1 Path Traversal |
|---|
| 描述 | MapQuest for Android (package com.mapquest.android.ace, version 10.16.1) is affected by a path traversal ("Dirty Stream", CWE-22 / CWE-23) reachable through its exported activity com.mapquest.android.ace.MainActivity. Exploitation is demonstrated with a working proof of concept (see Advisory/Exploit), not theoretical.
MainActivity registers an ACTION_SEND intent-filter for MIME type text/*. The wildcard text/* matches any concrete text/<subtype> (e.g. text/html), and the inbound share handler routes any non-text/plain subtype to a file-copy branch that reads EXTRA_STREAM. Any installed application, holding no Android permissions, can send an ACTION_SEND intent (type "text/html") carrying an EXTRA_STREAM content:// Uri to the exported activity and reach the copy. ACTION_SEND_MULTIPLE reaches the same sink per item; both cold start and warm delivery (onNewIntent) invoke it.
The copy uses the sending app's ContentProvider _display_name verbatim as the destination filename - File(context.cacheDir, fileName) - with no basename reduction, no canonical-path containment, and no ".." rejection. A malicious sender returning _display_name = "../databases/RKStorage" causes the streamed bytes to escape the cache directory and land at /data/data/com.mapquest.android.ace/databases/RKStorage.
Impact: attacker-controlled overwrite of files within MapQuest's private storage. Overwriting the AsyncStorage database (databases/RKStorage, table catalystLocalStorage) yields arbitrary control over the app's stored state, including session and authentication values, causing persistent forced-logout / denial of service and possible auth-state manipulation. No remote code execution was achievable in the analyzed build (the Hermes JS bundle loads from a read-only APK asset with no expo-updates/CodePush; native libraries load uncompressed from the read-only split APK; the only dynamic dex load is signature-checked Google Mobile Ads). The primitive escalates to code execution in any build that loads code from a writable path.
CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (6.1, Medium).
Root cause: the bundled Expo library expo-share-intent (function getDataColumn in ExpoShareIntentModule.kt), tracked as VulnDB #885425 and fixed upstream in achorein/expo-share-intent PR #221; vulnerable library range 0.2.1 - 8.0.0. Remediation: upgrade the bundled expo-share-intent once a fixed release is published, or apply the fix locally in the interim. |
|---|
| 来源 | ⚠️ https://docs.google.com/document/d/1NqFuHvwq66hpOfxTWPKlUB1_eMwLvujH/edit?usp=sharing&ouid=100768766778062598194&rtpof=true&sd=true |
|---|
| 用户 | Actuator (UID 67941) |
|---|
| 提交 | 2026-07-10 17時11分 (2 月前) |
|---|
| 管理 | 2026-09-01 21時48分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 397830 [MapQuest Get Directions App 10.16.1 于 Android com.mapquest.android.ace ExpoShareIntentModule.kt getDataColumn 目录遍历] |
|---|
| 积分 | 20 |
|---|