{"type": "hackapp", "published": "2017-04-27T04:25:05", "href": "https://hackapp.com/report/d863d7a694b33bb9e7ddd3424c7fcc29", "hashmap": [{"key": "affectedSoftware", "hash": "e752ca05b45571b3fa9304f98568b5ac"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cvss", "hash": "8cd4821cb504d25572038ed182587d85"}, {"key": "description", "hash": "c4c679ec48060f9033f10ec199bb23c7"}, {"key": "hackapp", "hash": "43afbccd795920a5e7865b414ce9d985"}, {"key": "href", "hash": "6bdb06e00a558ea7cfad2ffc3072aa93"}, {"key": "modified", "hash": "e4e677647837fe5cacd5a8d79c0fb532"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "e4e677647837fe5cacd5a8d79c0fb532"}, {"key": "references", "hash": "241ff493e6583ac1444fe825ce1af6e6"}, {"key": "reporter", "hash": "3b012aae1848bb95fe11f3cebae83cb0"}, {"key": "title", "hash": "a4ec7a667f47678e54014a7452dd91e6"}, {"key": "type", "hash": "96e87ef1fcc8d9d3cdd337488987c423"}], "bulletinFamily": "software", "cvss": {"vector": "NONE", "score": 0.0}, "viewCount": 7, "history": [], "edition": 1, "objectVersion": "1.2", "reporter": "Hackapp.org", "title": "Droid Informer - Dangerous filesystem permissions, Exported ContentProvider, WebView code execution vulnerabilities", "affectedSoftware": [{"operator": "le", "version": "Varies with device", "name": "Droid Informer"}], "enchantments": {"score": {"value": 1.3, "vector": "NONE", "modified": "2017-04-27T03:23:53"}, "dependencies": {"references": [], "modified": "2017-04-27T03:23:53"}, "vulnersScore": 1.3}, "references": ["https://play.google.com/store/apps/details?id=com.informer.androidinformer&hl=en"], "id": "HACKAPP:COM.INFORMER.ANDROIDINFORMER.APK", "hash": "d85aafb77f7de925c842a667bb6f78bc249ad754148b90455ee8adafdb160cb9", "lastseen": "2017-04-27T03:23:53", "cvelist": [], "modified": "2017-04-27T04:25:05", "description": "HackApp vulnerability scanner discovered that application Droid Informer published at the 'play' market has multiple vulnerabilities.", "hackapp": {"store": "play", "bugs": [{"id": "12818dfb15d31116cbcf6898024791e5", "severity": "notice", "name": "Unsafe deleting", "description": "All items deleted with 'file.delete()' could be recovered."}, {"id": "8764830796f75efd3517006455caa9e6", "severity": "critical", "name": "WebView code execution", "description": "WebView 'addJavascriptInterface' could be used to control the host app with JavaScript bindings. Remote Code Execution (RCE) is possible."}, {"id": "54a9e3b1451cbb726c28d7047be69c96", "severity": "medium", "name": "Exported components", "description": "Other applications could access the interfaces."}, {"id": "09196fb473164c00e621d0bc8e17e0b6", "severity": "notice", "name": "Suspicious files", "description": "Are you sure these files should be here?"}, {"id": "216a6c8950cca0d6b47646a874246b12", "severity": "critical", "name": "Dangerous filesystem permissions", "description": "Files created with these methods could be worldwide readable."}, {"id": "d16fe37fb8de0930a48f608f4abb28fb", "severity": "notice", "name": "External URLs", "description": "Were do they point?"}, {"id": "dc366d177cb411f1d7617866b19fac25", "severity": "medium", "name": "SD-card access", "description": "SD-cards and other external storages have 'worldwide read' policy."}, {"id": "4e82719f449b4d7b8f21aca2e2afba6c", "severity": "critical", "name": "Exported ContentProvider", "description": "Exported ContentProvider is available to other apps."}, {"id": "8f2803c64bc46324dd1955199ff75c38", "severity": "medium", "name": "WebView JavaScript enabled", "description": "WebView 'setJavaScriptEnabled(true)' could be exploited during cross-site scripting attacks."}, {"id": "ed499f070d08dbfdd3a0117410b60b74", "severity": "medium", "name": "WebView files access", "description": "Control of WebView context allows to access local files.\n\t\t\t"}], "version": "Varies with device", "name": "Droid Informer", "link": "https://play.google.com/store/apps/details?id=com.informer.androidinformer&hl=en", "release": "2017-04-13T00:00:00", "apk": "COM.INFORMER.ANDROIDINFORMER.APK", "vendor": "Informer Technologies.", "icon": "http://lh3.googleusercontent.com/MeD02s3uIskSB_m8mLT3Y-JJzW6iz9R44sKqYp1t1OKRfQvPjdKWiRhsD9cp9jzs-g=w300"}}

{}