Nextcloud Talk Android broadcast incorrect permission handling

Vulnerability

The Nextcloud Talk Android app up to version 14.1.0 contains an unprotected broadcast receiver in its CallActivity component. The receiver is not protected by a broadcastPermission, allowing any app on the device to send or receive broadcasts intended for the Talk app. This vulnerability affects all versions prior to 14.1.0 [1][2].

Exploitation

An attacker with a malicious app installed on the same Android device can register a receiver to intercept broadcasts sent to the Talk app's CallActivity. No special permissions are required beyond installation of the malicious app, as the broadcast receiver lacks permission enforcement. The attacker can then monitor these broadcasts without user interaction [2].

Impact

Successful exploitation allows a malicious app to eavesdrop on communication data transmitted via broadcasts, leading to unauthorized disclosure of sensitive information (confidentiality breach). There is no indication of integrity or availability impact from this vulnerability [2].

Mitigation

The vulnerability is fixed in Nextcloud Talk Android version 14.1.0, released on 2022-11-25. The fix introduces a custom permission for the broadcast receiver, preventing unauthorized apps from intercepting broadcasts [1][2]. No workarounds are available for this issue. Users should upgrade to 14.1.0 or later.