CyberRota Analysis
AI-GeneratedThe Datadog Android application is vulnerable due to its launcher activity being declared as exported without proper permission controls, allowing any installed application to invoke it with arbitrary session data. This flaw enables an attacker to perform automatic logins using a victim's OAuth access and refresh tokens, potentially compromising user identity and access to sensitive data. Organizations using the Datadog application on Android devices should prioritize addressing this vulnerability, particularly those with co-installed applications that could exploit this weakness.
Original NVD Description
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.