VNX-925: Broadcast receiver acts on an intent without verifying its action or sender

Field	Value
Rule ID	VNX-925
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin
CWE	CWE-925
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	android broadcast-receiver intent-verification cwe-925
Source	internal/sast/rules/vnx-925.rego

Overview

An Android BroadcastReceiver.onReceive(Context, Intent), named or anonymous, reads data from the intent it was handed (getStringExtra and the other get*Extra calls, getExtras()/extras, getData()/data, getDataString()) without ever checking the action (getAction()/intent.action, hasAction) or the sender (getSentFromPackage/getSentFromUid). The finding is on the onReceive declaration.

Why This Matters

Any app that can reach the receiver can send it a forged broadcast with its own extras, and the receiver acts on them: sending an SMS, opening a URL, wiping data.

What Gets Flagged

@Override
public void onReceive(Context context, Intent intent) {
    String phone = intent.getStringExtra("phone");
    SmsManager.getDefault().sendTextMessage(phone, null, note, null, null);
}

override fun onReceive(context: Context, intent: Intent) {
    val url = intent.getStringExtra("url") ?: return
    context.startActivity(Intent(Intent.ACTION_VIEW).setData(Uri.parse(url)))
}

Not flagged: receivers that check intent.getAction() / when (intent.action) or the sender, receivers that never read the intent’s data, an onReceive whose second parameter is not an Intent, test files, comments and strings. The manifest is not read: a receiver protected by a signature permission, registered with RECEIVER_NOT_EXPORTED or through LocalBroadcastManager is a false positive to suppress. Exported receivers are VNX-926.

Remediation

Check the action against the one the receiver expects before reading anything, and limit who can send it: android:exported="false", a signature-level android:permission, or RECEIVER_NOT_EXPORTED for runtime registration.

References

• CWE-925: Improper Verification of Intent by Broadcast Receiver
• Android: Broadcasts security considerations

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-925
// nosec vnx-925

Or record an ignore rule: vulnetix ignore add --rule vnx-925 --reason "...". See Suppressing findings.