This PR introduces a query that detects the issue described below.

Take into account that this depends on some CSV models that will need to be removed once #6397 and #6599 are merged. See ImplicitPendingIntents.qll for details.

Description

A PendingIntent describes an action in the form of an Intent that is intended to be given and executed at a later time by another application. The Intent wrapped by a PendingIntent is executed on behalf of the application that created it, and with its same privileges.

If a PendingIntent is configured to be mutable, the fields of its internal Intent can be changed by the receiving application if they were not previously set. This means that a mutable PendingIntent that has not defined a destination component (that is, an implicit PendingIntent) can be directed to any component by the receiving application, and execute an arbitrary action with the privileges of the application that created it.

If an implicit PendingIntent is wrapped and sent as an extra of an Intent that can be intercepted (that is, again, an implicit Intent), any malicious application could obtain the PendingIntent, modify the underlying Intent with an arbitrary destination component, and execute the desired action with elevated privileges. This could give the malicious application access to private components of the victim application, or the ability to perform actions without having the necessary permissions.

References

• All About PendingIntents
• Remediation for Implicit PendingIntent Vulnerability
• PIAnalyzer: A precise approach for PendingIntent vulnerability analysis