CVE-2023-46918

Executive Summary

CVE-2023-46918 affects the Android application Simple HTTP Server PLUS (package: com.phlox.simpleserver.plus) version 1.8.1-plus. The vulnerability arises from the Android manifest file containing the attribute android:allowBackup set to true. This misconfiguration allows an attacker with physical access to the device to extract the application’s backup data, which may include sensitive files, configuration, or user data. The CVSS score is 0.0 due to the requirement of physical access, but the risk is real in scenarios where devices are lost, stolen, or temporarily accessible to an adversary.

Supply Chain & Package Security

This vulnerability is specific to the Android application ecosystem. The application is distributed via the Google Play Store or third-party APK repositories. The misconfiguration in the manifest file is a supply chain risk because it originates from the developer’s build configuration. Users who install the app from untrusted sources may be at higher risk if the app is repackaged with additional malicious code.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 4.6)
• Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Physical (AV:P) – Requires physical access to the device.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – Backup may contain sensitive data.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: Medium (due to physical access requirement, but high impact if exploited)

Deep Dive & Mechanics

The Android android:allowBackup attribute controls whether an application’s data can be backed up via Android’s built-in backup mechanism. When set to true, the app’s data (including databases, shared preferences, and files in the app’s private directory) can be extracted using the adb backup command. An attacker with physical access to the device can connect it to a computer, enable USB debugging (if not disabled), and run:

adb backup -f backup.ab com.phlox.simpleserver.plus

This creates a backup file (backup.ab) that can be converted to a tar archive using tools like abe (Android Backup Extractor). The attacker can then inspect the contents for sensitive information such as server configuration, passwords, or user data.

The vulnerability is present in the AndroidManifest.xml file of the application. The relevant entry is:

<application android:allowBackup="true" ...>

The fix would be to set android:allowBackup="false" or implement a custom backup agent that restricts what data is backed up.

Vulnerable vs. Patched Code

Vulnerable (1.8.1-plus):

<application
    android:allowBackup="true"
    android:icon="@mipmap/ic_launcher"
    android:label="@string/app_name"
    ... >

Patched (hypothetical):

<application
    android:allowBackup="false"
    android:icon="@mipmap/ic_launcher"
    android:label="@string/app_name"
    ... >

No official patch has been released as of the last update.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Android device with USB debugging enabled (or attacker can enable via recovery mode).
• ADB (Android Debug Bridge) installed on attacker machine.
• Android Backup Extractor (abe) tool.

Steps:

1. Connect the target device to the attacker machine via USB.
2. Verify device is recognized: adb devices
3. Create a backup of the vulnerable app:

   adb backup -f backup.ab com.phlox.simpleserver.plus
   

4. Convert the backup to tar format:

   java -jar abe.jar unpack backup.ab backup.tar
   

5. Extract the tar archive:

   tar -xvf backup.tar
   

6. Browse the extracted files for sensitive data (e.g., shared_prefs/, databases/).

Blue Team

Detection:

• Monitor for unauthorized USB connections to corporate devices.
• Use Mobile Device Management (MDM) policies to disable USB debugging and enforce android:allowBackup="false" for all apps.
• Deploy endpoint detection and response (EDR) agents on Android devices that alert on adb backup commands.

Prevention:

• Ensure all in-house apps have android:allowBackup="false" in their manifest.
• Use Android Enterprise or similar to enforce security policies.
• Educate users not to enable USB debugging on production devices.

Indicators of Compromise (IOCs)

• File: backup.ab (Android backup file) on attacker machine.
• Process: adb backup command execution.
• Network: Unusual USB connections to devices.
• Registry/Config: Android manifest with android:allowBackup="true" for com.phlox.simpleserver.plus.

Detection Engineering

YARA Rule

rule android_allowBackup_true {
    meta:
        description = "Detects Android manifest files with allowBackup set to true"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-46918"
    strings:
        $manifest = "AndroidManifest.xml" nocase
        $backup_true = "android:allowBackup=\"true\"" nocase
    condition:
        $manifest and $backup_true
}

Sigma Rule

title: Android Backup Enabled via ADB
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects execution of adb backup command on a device
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\adb.exe'
        CommandLine|contains: 'backup'
    condition: selection
falsepositives:
    - Legitimate developer debugging
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 5555 (msg:"CVE-2023-46918 - Android ADB Backup Attempt"; flow:to_server; content:"backup"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: If you are the developer, update the AndroidManifest.xml to set android:allowBackup="false" and release a new version.
2. User: Uninstall the app or restrict its permissions via Android settings. Avoid using the app on devices that may be lost or stolen.
3. Enterprise: Use MDM to block apps with android:allowBackup="true" and enforce device encryption.
4. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation attempts.
5. Long-term: Follow Android security best practices, including disabling backup for sensitive apps.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert