Malicious Android app could access Shared Preferences of the Nextcloud Android client

Vulnerability

The Nextcloud Android application, in versions prior to 3.16.1, exposes its shared preferences to other apps on the same device when the user initiates the Android sharing flow and selects a malicious app. The shared preferences contain limited private data, including push tokens and the account name. This vulnerability is addressed in pull request #8433 [1].

Exploitation

Exploitation requires user interaction: the victim must start the share action from within the Nextcloud app and choose the attacker's app as the destination. No additional privileges are needed; the malicious app must be installed on the same device [2].

Impact

Upon successful exploitation, the malicious app gains access to the shared preferences file. The leaked data includes push notification tokens and the Nextcloud account name, which could be used for further attacks or account-related abuse. The sensitivity is limited as full credentials or file contents are not exposed [2].

Mitigation

The vulnerability is patched in Nextcloud Android app version 3.16.1, which was released on 2021-06-17. Users should update to this version or later via the Google Play Store or other distribution channels. No workarounds are available for versions prior to 3.16.1 [2].