Micro shareit play storecimpanuzdnet android#

ShareIt's incredible success of a billion Android downloads and 1.8 billion users worldwide (there are also iOS, Windows, and Mac apps) has led to what looks like an.

xml file and most of the URLs therein use the insecure http protocol, making them possible MITM vectors as well.Any app can invoke this broadcast component. This shows arbitrary activities, including SHAREit’s internal (non-public) and external app activities. The developer behind this disabled the exported attribute via android:exported='false', but enabled the android:grantUriPermissions='true' attribute. SHAREit is one of the world's largest offline and online platform that provides file sharing, content streaming and gaming platform. This indicates that any third-party entity can still gain temporary read/write access to the content provider's data.Įven worse, the developer specified a wide storage area root path. The flaws exist in an app called SHAREit, which allows Android app users to share files between friends or devices. It has a strong market presence in APAC, Middle East, Africa.

In this case, all files in the /data/data/ folder can be freely accessed. The following code from our POC reads WebView cookies.

Catalin Cimpanu / ZDNet: Trend Micro details an unpatched remote code execution bug in the Android version of SHAREit, an app with 1B+ Play Store downloads. This can also be used to write any files in the app’s data folder. In other words, it can be used to overwrite existing files in the SHAREit app.