VNX-927: Implicit Intent broadcast that any app can receive
Reports an Android broadcast that any installed app can receive (CWE-927) in Java and Kotlin: sendBroadcast(i), sendOrderedBroadcast(i, null[, resultReceiver, ...]) or sendBroadcastAsUser(i, user) with no receiver permission (the call's arguments may start on the next line), where i is built a few lines above as an implicit Intent (new Intent(), new Intent("action") or new Intent(ACTION_CONSTANT), Kotlin Intent(...)) and no setPackage/setComponent/setClass/setClassName (or package/component assignment) makes it explicit before the send; the same call with the implicit Intent built inline; and every sendStickyBroadcast/sendStickyOrderedBroadcast, whose extras any app can read back. Not reported: a broadcast with a permission argument, explicit Intents (new Intent(context, Receiver.class) or one given a package or component), LocalBroadcastManager sends, comments and strings. Intents built in another method or passed in as a parameter are not followed.
| Field | Value |
|---|---|
| Rule ID | VNX-927 |
| Severity | Medium |
| SARIF level | warning |
| Kind | sast |
| Languages | Java, Kotlin |
| CWE | CWE-927 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C |
| Tags | use-of-implicit-intent android cwe-927 |
| Source | internal/sast/rules/vnx-927.rego |
Overview
Reports an Android broadcast that any installed app can receive (CWE-927) in Java and Kotlin: sendBroadcast(i) or sendOrderedBroadcast(i, null) with no receiver permission, where i is built a few lines above as an implicit Intent (new Intent(), new Intent(“action”) or new Intent(ACTION_CONSTANT), Kotlin Intent(…)) and no setPackage/setComponent/setClass/setClassName (or package/component assignment) makes it explicit before the send; the same call with the implicit Intent built inline; and every sendStickyBroadcast/sendStickyOrderedBroadcast, whose extras any app can read back. Not reported: a broadcast with a permission argument, explicit Intents (new Intent(context, Receiver.class) or one given a package or component), LocalBroadcastManager sends, comments and strings. Intents built in another method or passed in as a parameter are not followed.
Why This Matters
An implicit broadcast is delivered to every app that registers a matching intent filter. Session ids, tokens or personal data put in its extras are readable by any installed app, and a sticky broadcast stays readable after it is sent.
What Gets Flagged
Intent update = new Intent("com.example.bank.BALANCE");
update.putExtra("balance", balance);
context.sendBroadcast(update);
sendBroadcast(new Intent("com.example.bank.SESSION").putExtra("sid", sessionId));
ctx.sendStickyBroadcast(status);What Is Not Flagged
Intent i = new Intent("com.example.bank.BALANCE");
i.setPackage(context.getPackageName());
context.sendBroadcast(i);
context.sendBroadcast(new Intent(context, BalanceReceiver.class));
context.sendBroadcast(i, "com.example.permission.BANK");
LocalBroadcastManager.getInstance(ctx).sendBroadcast(i);Remediation
- Make the Intent explicit with
setPackage,setComponentor a class-based constructor. - Or pass a
signature-level receiver permission tosendBroadcast(intent, permission). - Do not use sticky broadcasts; they are deprecated and readable by any app.
- For a confirmed false positive, add a
vulnetix-ignore: VNX-927comment on the line.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-927
// nosec vnx-927Or record an ignore rule: vulnetix ignore add --rule vnx-927 --reason "...". See Suppressing findings.