# [IRCCloud Android] Opening arbitrary URLs/XSS in SAMLAuthActivity

Exported SAMLAuthActivity in IRCCloud Android loads attacker-supplied auth_url into a WebView with attacker-controlled title, enabling phishing/XSS.

- Payout: hidden
- Severity: medium
- Program: IRCCloud
- Found by: bagipro
- Disclosed: 2017-11-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/283058
- Library page: https://bugbountylibrary.com/r/h1%3A283058
- Tags: area:mobile domain:mobile impact:ato kind:bounty platform:hackerone sev:medium tech:android technique:source-review vuln:misconfiguration vuln:xss

**Target:** Android exported activity with WebView
**Root cause:** SAMLAuthActivity is exported and reads auth_url and title extras from any caller's Intent, loading the URL into a WebView without validation or origin checks.
**Steps:**
1. Identify exported activity `com.irccloud.android.activity.SAMLAuthActivity` via manifest intent-filter.
2. Note code loads `getIntent().getStringExtra("auth_url")` into `mWebView.loadUrl(...)` and sets title from `title` extra.
3. Trigger via ADB: `adb shell am start -n com.irccloud.android/com.irccloud.android.activity.SAMLAuthActivity -e title "ATTAAACK" -e auth_url "http://google.com/"`
4. Observe WebView opens arbitrary URL with spoofed title.
**How found:** Researcher reviewed the AndroidManifest, spotted the exported SAMLAuthActivity, then read the activity source to find unvalidated Intent extras passed to WebView.loadUrl.
**Exploitation:** A malicious app (or Instant App from browser) launches the exported activity with an attacker URL and a spoofed title like 'IRCCloud: Login Required', displaying a phishing page in-app where the user cannot see the real URL, enabling credential theft.
**Insight:** On Android targets, grep the manifest for exported activities with intent-filters, then check whether their source passes Intent extras (URLs, titles) directly into WebView.loadUrl — a common phishing/XSS vector reachable by any installed app.