# Improper protection of FileContentProvider

Nextcloud Android FileContentProvider authorized callers by substring-matching package name, so any app with 'com.nextcloud.client' in its package could read E2E private keys.

- Payout: hidden
- Severity: low
- Program: Nextcloud
- Found by: mmmds
- Disclosed: 2020-03-01
- CVE: CVE-2018-3765
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/331302
- Library page: https://bugbountylibrary.com/r/h1%3A331302
- Tags: area:mobile domain:mobile impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:low technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Android FileContentProvider (com.owncloud.android.providers.FileContentProvider)
**Root cause:** isCallerNotAllowed() checks whether the calling package name merely contains the app's package name as a substring rather than requiring an exact match, so any package embedding that string passes the check.
**Steps:**
1. Install a malicious app whose package name contains the substring `com.nextcloud.client` (e.g. `com.nextcloud.client.evil`).
2. From that app, query the exported provider at `content://org.nextcloud/arbitrary_data`.
3. The provider's isCallerNotAllowed() returns false because the calling package contains the target package name, granting access.
4. Read protected data such as end-to-end encryption private keys.
**How found:** Code review of the provider's caller-validation logic revealed a substring check (contains) instead of an exact package comparison.
**Exploitation:** A malicious app with a crafted package name containing 'com.nextcloud.client' accesses FileContentProvider URIs (e.g. content://org.nextcloud/arbitrary_data) without restriction, exfiltrating private E2E encryption keys.
**Insight:** When auditing Android providers, look for caller checks using contains()/startsWith() on package names or UIDs; package names are attacker-controlled at install time, so substring matching is trivially bypassed by embedding the trusted name.