CVE-2023-26321

Executive Summary

CVE-2023-26321 is a path traversal vulnerability in the Xiaomi File Manager application (international version). The flaw arises from unfiltered special characters in file path handling, allowing an attacker to overwrite and execute arbitrary code within the application’s sandbox. With a CVSS score of 6.3 (Medium), the vulnerability requires local access or user interaction to exploit, but once triggered, it can lead to code execution and potential privilege escalation. No public proof-of-concept (PoC) or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies for DevSecOps teams.

Supply Chain & Package Security

This vulnerability affects a proprietary Android application (Xiaomi File Manager) distributed via the Google Play Store and Xiaomi’s app store. It is not an open-source package (NPM, PyPI, Go, Ruby), so supply chain risks are limited to the app’s distribution channels. However, users should verify app integrity via checksums and only download from official stores.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 6.3 (Medium)
• Attack Vector: Local (AV:L) – requires physical or ADB access to the device.
• Attack Complexity: Low (AC:L) – no special conditions needed.
• Privileges Required: None (PR:N) – attacker does not need prior access.
• User Interaction: Required (UI:R) – victim must open a malicious file or link.
• Scope: Unchanged (S:U) – vulnerability affects only the app’s sandbox.
• Confidentiality Impact: High (C:H) – attacker can read arbitrary files.
• Integrity Impact: High (I:H) – attacker can overwrite app files.
• Availability Impact: High (A:H) – code execution can crash the app or device.

Threat Level: Medium. While the CVSS score is moderate, the potential for code execution and file overwrite makes it a serious risk for Xiaomi device users, especially in enterprise environments where file manager apps are used for document handling.

Deep Dive & Mechanics

The vulnerability exists in the Xiaomi File Manager’s file path handling logic. The application fails to sanitize special characters (e.g., ../, ..\\, or null bytes) when processing file operations such as copy, move, or rename. An attacker can craft a malicious file or intent that includes path traversal sequences, causing the app to write files outside its intended directory.

Root Cause:

• The app uses File or Path APIs without validating user-supplied paths.
• Special characters like ../ are not filtered, allowing directory traversal.
• The app runs with the same UID as the user, so it can access /sdcard/ and app-specific directories.

Attack Scenario:

1. Attacker creates a ZIP archive containing a file with a path like ../../data/data/com.mi.android.globalFileexplorer/shared_prefs/config.xml.
2. Victim opens the ZIP in Xiaomi File Manager.
3. The app extracts the file, overwriting its own configuration.
4. The attacker can then inject malicious code (e.g., a modified classes.dex) to execute arbitrary commands.

Impact:

• Overwrite app resources (e.g., AndroidManifest.xml, classes.dex).
• Execute code with the app’s permissions (e.g., access contacts, SMS, or storage).
• Potential privilege escalation if the app has system-level permissions.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable pattern:

Vulnerable Code (Java/Kotlin):

public void extractFile(ZipEntry entry, String destDir) {
    File destFile = new File(destDir, entry.getName());
    // No path validation
    FileOutputStream fos = new FileOutputStream(destFile);
    // ... copy data
}

Patched Code (Hypothetical):

public void extractFile(ZipEntry entry, String destDir) {
    String entryName = entry.getName();
    // Normalize and validate path
    File destFile = new File(destDir, entryName);
    String canonicalPath = destFile.getCanonicalPath();
    String canonicalDestDir = new File(destDir).getCanonicalPath();
    if (!canonicalPath.startsWith(canonicalDestDir)) {
        throw new SecurityException("Path traversal detected");
    }
    FileOutputStream fos = new FileOutputStream(destFile);
    // ... copy data
}

Key Differences:

• The patched version uses getCanonicalPath() to resolve ../ sequences.
• It checks that the resolved path starts with the intended destination directory.
• This prevents writing files outside the target folder.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Xiaomi device with vulnerable File Manager (international version).
• ADB enabled or user interaction to open a malicious file.
• No public PoC available; the following is a conceptual exploit.

Exploit Steps:

1. Create a malicious ZIP file with a path traversal payload:

   mkdir -p exploit
   cd exploit
   echo "malicious_code" > "../../data/data/com.mi.android.globalFileexplorer/files/evil.dex"
   zip -r malicious.zip .
   

2. Transfer the ZIP to the device via ADB or social engineering.
3. Victim opens the ZIP in Xiaomi File Manager and extracts it.
4. The app overwrites its own files, leading to code execution.

Alternative Payload:

• Overwrite shared_prefs to modify app settings.
• Overwrite lib/armeabi-v7a/libnative.so to execute native code.

Blue Team

Detection & Prevention:

• Monitor file system events for unexpected writes to app directories.
• Use Android’s FileProvider to restrict file access.
• Implement input validation for all file paths.

Lab Setup for Testing:

• Use an Android emulator (e.g., Android Studio) with Xiaomi File Manager installed.
• Enable ADB and use adb shell to monitor file changes.
• Test with crafted ZIP files and observe behavior.

Indicators of Compromise (IOCs)

• File Hashes:
  • Malicious ZIP files with path traversal patterns (e.g., ../../ in entry names).
• Network:
  • Unusual outbound connections from the File Manager app (if code execution leads to C2).
• File System:
  • Unexpected files in /data/data/com.mi.android.globalFileexplorer/ (e.g., modified shared_prefs, files, or lib).
• Process:
  • com.mi.android.globalFileexplorer spawning child processes (e.g., sh, su).
• Logs:
  • Android logcat entries with SecurityException or path traversal errors.

Detection Engineering

YARA Rule

rule CVE_2023_26321_Xiaomi_FileManager_PathTraversal {
    meta:
        description = "Detects path traversal attempts in Xiaomi File Manager"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-26321"
    strings:
        $path_traversal1 = "../" ascii wide nocase
        $path_traversal2 = "..\\" ascii wide nocase
        $path_traversal3 = "%2e%2e%2f" ascii wide nocase
        $xiaomi_pkg = "com.mi.android.globalFileexplorer" ascii wide nocase
    condition:
        any of ($path_traversal*) and $xiaomi_pkg
}

Sigma Rule

title: CVE-2023-26321 Path Traversal in Xiaomi File Manager
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects file operations with path traversal sequences targeting Xiaomi File Manager
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: android
detection:
    selection:
        Image|endswith: 'com.mi.android.globalFileexplorer'
        TargetFilename|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some apps
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2023-26321 Xiaomi File Manager Path Traversal"; flow:to_server,established; content:"com.mi.android.globalFileexplorer"; http_uri; content:"../"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

• Disable or uninstall Xiaomi File Manager until a patch is released.
• Use alternative file manager apps (e.g., Google Files, Solid Explorer).
• Restrict app permissions (e.g., disable storage access for untrusted apps).

Long-term Fixes:

• Apply input validation and canonical path checks (see patched code).
• Use Android’s FileProvider to serve files securely.
• Implement code signing and integrity checks for app resources.

Vendor Response:

• Xiaomi has not released a patch as of this report. Monitor official channels for updates.
• Consider using a mobile device management (MDM) solution to enforce app blacklists.

Valters IT
Securing Digital Frontiers