# Persistant Arbitrary code execution in mattermost android

Exported ShareActivity trusts a content provider's _display_name, allowing path traversal to overwrite libyoga.so and achieve persistent code execution in Mattermost Android.

- Payout: hidden
- Severity: high
- Program: Mattermost
- Found by: hulkvision_
- Disclosed: 2021-06-03
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/1115864
- Library page: https://bugbountylibrary.com/r/h1%3A1115864
- Tags: area:mobile domain:mobile impact:integrity impact:rce kind:bounty platform:hackerone sev:high tech:android technique:source-review vuln:path-traversal vuln:rce

**Target:** Android app exported ShareActivity / RealPathUtil temp-file save
**Root cause:** RealPathUtil.getPathFromSavingTempFile uses the attacker-controlled OpenableColumns.DISPLAY_NAME from a content provider as the temp filename without sanitizing path separators, so `../` escapes the cache dir.
**Steps:**
1. Build a malicious app exporting a ContentProvider whose query() returns `_display_name` = `../../lib-main/libyoga.so` and openFile() serves an attacker-controlled .so.
2. Send `Intent.ACTION_SEND` with setClassName(`com.mattermost.rn`,`com.mattermost.share.ShareActivity`) and STREAM uri `content://com.example.android.pocok/?path=/data/data/com.example.android.pocok/libevil-lib.so&name=../../lib-main/libyoga.so`.
3. Mattermost copies the file via RealPathUtil into `new File(cacheDir, fileName)`, traversing to the app's lib-main directory and overwriting libyoga.so.
4. On next app launch the malicious native library loads and executes.
**How found:** Noticed ShareActivity is exported with a SEND intent-filter accepting `*/*`, then read RealPathUtil and saw the provider-supplied DISPLAY_NAME used directly as a filename in `new File(cacheDir, fileName)`.
**Exploitation:** Attacker ships a companion app with an exported ContentProvider; a single ACTION_SEND intent to the exported ShareActivity causes Mattermost to write attacker bytes over libyoga.so in its native lib dir, yielding persistent code execution on next launch.
**Insight:** Exported Android share/receive activities that copy provider files into app-private storage are prime targets: check whether DISPLAY_NAME is used as a raw filename, and whether the destination dir is on the native library load path (lib-main) for persistence.