# Leak arbitrary file under nextcloud android client privacy directory

Malicious GET_CONTENT activity returns a file:// URI to Nextcloud's upload picker, leaking the app's private shared_prefs XML including push token.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: wester0x01
- Disclosed: 2021-07-17
- CVE: CVE-2021-32695
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1142918
- Library page: https://bugbountylibrary.com/r/h1%3A1142918
- Tags: area:mobile domain:mobile impact:data-leak kind:bounty platform:hackerone sev:medium tech:android vuln:info-disclosure vuln:path-traversal

**Target:** Android client upload-from-other-apps content picker
**Root cause:** Nextcloud's upload picker trusts the data URI returned by any activity registered for GET_CONTENT and reads it without validating scheme/authority, so a malicious app can return a file:// path into Nextcloud's own private data directory.
**Steps:**
1. Install and log into Nextcloud Android client; create a shareable directory.
2. Install PoC app declaring an activity with intent-filter action GET_CONTENT, categories DEFAULT/OPENABLE, mimeType */*.
3. In Nextcloud, open the shareable folder, tap '+', choose 'upload content from other apps'.
4. Select the PoC app; its EvilActivity calls `setResult(-1, new Intent().setData(Uri.parse("file:///data/data/com.nextcloud.client/shared_prefs/com.nextcloud.client_preferences.xml")))` and finishes.
5. Nextcloud reads the returned file:// URI and uploads the private prefs XML into the shared folder, exposing push token and account info.
**Exploitation:** Victim must select the malicious app from the content picker; the app returns a file:// URI pointing at Nextcloud's own private shared_prefs, which Nextcloud then uploads to a shareable folder, leaking the file contents.
**Insight:** When an app consumes content from external providers via GET_CONTENT, test whether it honors file:// URIs pointing into its own /data/data sandbox instead of only content:// URIs; a malicious provider can hand back the app's own private files.