In other words, it can be used to overwrite existing files in the SHAREit app. This can also be used to write any files in the app’s data folder.
The following code from our POC reads WebView cookies. It may also be downloaded onto non-Lenovo Windows or Android devices. In this case, all files in the /data/data/ folder can be freely accessed. Lenovo SHAREit is an application that may be preloaded on some Lenovo mobile devices or Think, IdeaPad or Lenovo notebook computers. The free technology used by one billion users transfers data 200 times fast than Bluetooth.
This indicates that any third-party entity can still gain temporary read/write access to the content provider's data.Įven worse, the developer specified a wide storage area root path. Free Download 4.0.6.177 SHAREit for PC works as a cross-platform to transfer any type of data (audio, video, document, GIF, etc.) from mobile to mobile and from mobile to PC.
The developer behind this disabled the exported attribute via android:exported="false", but enabled the android:grantUriPermissions="true" attribute. This shows arbitrary activities, including SHAREit’s internal (non-public) and external app activities. Any app can invoke this broadcast component.
0 kommentar(er)
