Dropbox for Android security bypass vulnerability

A security issue has been reported in Dropbox for Android, which can be exploited by malicious people to bypass certain security restrictions, according to Tyrone Erasmus of MWR InfoSecurity.

Android applications can communicate with each other through the exporting of program features, also known as IPC endpoints. This is defined in the AndroidManifest.xml file which is part of all installable application packages.

Any feature of an Android application can be exported, meaning that other applications can access these features and interact with the application across the sandbox. In some cases this can pose a security risk to the application exporting its features. The issue with the Dropbox application is that the exported content provider can be leveraged by a malicious application to upload a file from the device to the linked Dropbox account without interaction from the user. It is also possible to upload the Dropbox settings and content databases using this same technique.