CVE-2023-6949

Executive Summary

CVE-2023-6949 exposes a critical authentication bypass vulnerability in the DJI Mavic Mini 3 Pro drone’s HTTP service (port 80). An unauthenticated attacker on the same network can enumerate and download all videos and pictures stored on the drone’s internal or external memory without any credentials. This flaw stems from a Missing Authentication for Critical Function (CWE-306) and poses a high confidentiality risk to drone operators, especially in sensitive or private environments. No patch has been released by DJI as of this report, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the attack surface is significant for targeted operations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.2 (Medium)
• Attack Vector (AV): Adjacent Network – attacker must be on the same Wi-Fi network as the drone.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – exploitation does not affect other components.
• Confidentiality (C): High – all stored media can be exfiltrated.
• Integrity (I): None – no data modification possible.
• Availability (A): None – no denial of service.

Threat Level: Medium. The attack requires physical proximity to the drone’s Wi-Fi network, but once connected, full media access is granted without authentication. This is particularly dangerous for journalists, law enforcement, or hobbyists capturing sensitive footage.

Deep Dive & Mechanics

The DJI Mavic Mini 3 Pro runs an HTTP server on TCP port 80 to serve media files (photos and videos) to the DJI Fly mobile app. The server exposes endpoints such as /media/ or /DCIM/ that list and serve files. Due to missing authentication checks, any HTTP request to these endpoints is processed without verifying the client’s identity. The drone’s Wi-Fi network is typically open or uses a simple WPA2 password, but the HTTP service itself does not enforce any access control.

Attack Flow:

1. Attacker connects to the drone’s Wi-Fi network (SSID typically starts with “DJI_”).
2. Attacker sends HTTP GET requests to the drone’s IP (usually 192.168.1.1) on port 80.
3. The server responds with directory listings or direct file downloads of all media stored on the drone’s internal memory or SD card.
4. Attacker downloads all files without any authentication.

Root Cause: The HTTP server lacks any session management, token validation, or basic authentication for file enumeration and download endpoints. The DJI Fly app likely uses a proprietary protocol or hidden headers, but the server does not enforce them.

Vulnerable vs. Patched Code

No official patch exists. The vulnerable code is in the drone’s firmware HTTP server. A patched version would require implementing authentication, such as:

• Requiring a session token obtained from the DJI Fly app after pairing.
• Using HTTP Basic Authentication with a pre-shared key.
• Restricting access to only the paired mobile device via MAC filtering.

Vulnerable Code (Conceptual):

# Vulnerable HTTP server handler
def handle_request(request):
    if request.path.startswith("/media/"):
        # No authentication check
        serve_file(request.path)

Patched Code (Conceptual):

# Patched HTTP server handler
def handle_request(request):
    if request.path.startswith("/media/"):
        if not is_authenticated(request):
            return 401 Unauthorized
        serve_file(request.path)

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• DJI Mavic Mini 3 Pro with firmware version vulnerable to CVE-2023-6949.
• Laptop with Wi-Fi adapter and Python/curl installed.
• Drone powered on and in Wi-Fi mode (not connected to a controller).

Exploitation Steps:

1. Connect to the drone’s Wi-Fi network (e.g., SSID DJI_123456).
2. Identify drone IP (usually 192.168.1.1).
3. Enumerate media directories:

   curl http://192.168.1.1/DCIM/
   

4. Download all files:

   wget -r -np http://192.168.1.1/DCIM/
   

5. Alternatively, use a Python script to automate:

   import requests
   drone_ip = "192.168.1.1"
   response = requests.get(f"http://{drone_ip}/DCIM/")
   # Parse and download files
   

No public exploit code is available; this is a manual exploitation scenario.

Blue Team (Defensive)

Detection & Prevention:

• Monitor for unexpected connections to the drone’s Wi-Fi network.
• Use network segmentation: do not connect the drone to a corporate or sensitive network.
• Enable WPA2 encryption on the drone’s Wi-Fi (if supported) to limit unauthorized access.
• Regularly check for firmware updates from DJI.
• If possible, disable the HTTP service when not in use (e.g., via drone settings).

Honeypot Strategy:

• Deploy a fake DJI drone HTTP server on port 80 to lure attackers and log their IPs and requests.

Indicators of Compromise (IOCs)

• Network:
  • Unusual HTTP GET requests to /DCIM/, /media/, or /MISC/ on port 80.
  • Connections from unknown MAC addresses to the drone’s Wi-Fi network.
• File System:
  • Presence of downloaded media files on an attacker’s device (not directly observable on the drone).
• Logs:
  • Drone logs (if accessible) showing HTTP requests without a valid session token.

Example IOC Log Entry:

192.168.1.2 - - [01/Jan/2024:12:00:00] "GET /DCIM/100MEDIA/VID_20240101.mp4 HTTP/1.1" 200 123456

Detection Engineering

YARA Rule

rule CVE_2023_6949_DJI_HTTP_Auth_Bypass {
    meta:
        description = "Detects HTTP requests to DJI drone media endpoints without authentication"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-6949"
    strings:
        $media_path = "/DCIM/" nocase
        $media_path2 = "/media/" nocase
        $http_get = "GET" nocase
    condition:
        $http_get at 0 and ($media_path or $media_path2)
}

Sigma Rule

title: DJI Mavic Mini 3 Pro HTTP Media Access Without Auth
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated HTTP GET requests to DJI drone media directories
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6949
tags:
    - attack.t1190
    - cve.2023.6949
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/DCIM/'
            - '/media/'
    condition: selection
falsepositives:
    - Legitimate DJI Fly app connections (should be rare if app uses different endpoints)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2023-6949 DJI Mavic Mini 3 Pro Unauthenticated Media Access"; flow:to_server,established; content:"GET"; http_method; content:"/DCIM/"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTTP service if not required (check drone settings).
2. Change Wi-Fi password to a strong WPA2 key to limit network access.
3. Monitor network for unauthorized connections to the drone’s SSID.
4. Use a VPN or separate network segment for drone operations.

Long-Term Fix:

• DJI must release a firmware update that adds authentication to the HTTP service. Until then, users should treat the drone’s Wi-Fi as untrusted and never connect it to sensitive networks.

Workaround:

• Use the DJI Fly app only and avoid direct HTTP access. The app may use proprietary protocols that are not vulnerable.

Valters IT