CVE-2024-25466

Executive Summary

CVE-2024-25466 is a directory traversal vulnerability identified in the React Native Document Picker library, affecting versions prior to v9.1.1. The flaw resides in the Android library component and allows a local attacker to execute arbitrary code by crafting a malicious script that exploits inadequate path validation during file selection operations. Enterprise mobile applications built with React Native that integrate the Document Picker module are at risk, particularly in environments where untrusted applications share the same device. Successful exploitation can lead to arbitrary code execution within the context of the vulnerable application, potentially enabling data exfiltration, credential theft, or lateral movement within a mobile device management (MDM) environment.

Technical Analysis

The vulnerability is rooted in the Android implementation of the React Native Document Picker library, specifically within the file URI handling and path traversal mechanisms. The library is responsible for presenting a document picker interface to users and subsequently processing the selected file's URI. In versions prior to 9.1.1, the library fails to adequately sanitize or validate file paths retrieved from the Android ContentResolver or Intent data.

Directory traversal, also classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), occurs when user-controlled input is concatenated into a file system path without adequate validation. In this specific case, a malicious application on the same Android device can craft an intent that returns a file URI containing path traversal sequences (e.g., ../../../../data/data/com.victim.app/shared_prefs/). The Document Picker library, upon receiving this URI, resolves it against the underlying file system without verifying that the resolved path remains within the intended sandboxed directory.

The code-level mechanism can be understood as follows: the library typically invokes onActivityResult() to process the URI returned by the Android system's file picker. If the URI scheme is file://, the library extracts the path and passes it directly to file I/O operations. An attacker-controlled app can register a ContentProvider that returns a malicious URI or intercept the picker flow to inject a crafted path. The absence of canonicalization checks (e.g., resolving .. segments) allows the library to access files outside its designated storage area, including application-private data, system configuration files, or executable dex/JAR files.

The attack surface is primarily local, requiring the victim device to have the malicious application installed alongside the legitimate application using the vulnerable React Native Document Picker. However, in enterprise BYOD (Bring Your Own Device) scenarios or MDM-managed environments, the risk is amplified because devices often contain sensitive corporate data and multiple applications from various sources.

The payload for arbitrary code execution could involve overwriting or injecting a malicious DEX file into the victim application's data directory, which may then be loaded by the application's class loader during subsequent launches. Alternatively, an attacker could target the application's JavaScript bundle (React Native's JS bundle) stored on the file system, replacing it with malicious code that executes within the React Native runtime context.

Exploitation Scenarios

The following attack chain outlines a realistic exploitation scenario for CVE-2024-25466:

1. Reconnaissance and Target Identification: An attacker identifies an enterprise mobile application that uses React Native and integrates a vulnerable version of the Document Picker library (pre-9.1.1). The attacker may decompile the target APK to inspect its package.json or native library metadata, or use static analysis tools to grep for react-native-document-picker in the app's bundled JavaScript. The attacker also profiles the target device environment, confirming that the app's data directory is accessible via the storage permissions available to other apps (e.g., on older Android versions or with scoped storage incorrectly implemented).

2. Weaponization and Trigger: The attacker develops a malicious Android application that registers a malicious ContentProvider or attempts to interact with the document picker intent. The malicious app constructs an Intent with ACTION_OPEN_DOCUMENT or ACTION_GET_CONTENT and sets the data URI to a crafted value containing path traversal sequences. Specifically, the attacker uses a file:// URI such as file:///data/data/com.target.app/files/../../../../data/data/com.target.app/shared_prefs/credentials.xml. The attacker then triggers the victim application to launch the picker, which honors the URI from the malicious provider.

3. Payload Delivery and Execution: Upon receiving the malicious URI through onActivityResult, the vulnerable Document Picker library resolves the path without canonicalization. The library performs file operations (e.g., copying the file content into the app's cache or reading metadata) using the traversed path. In a more advanced scenario, the attacker uses the traversal to write data: the library's "copy file to cache" functionality is coerced into writing a crafted DEX file or malicious JavaScript bundle into the victim app's files/ or cache/ directory by manipulating the destination path with traversal sequences. The attacker can also target the app's lib/ directory to overwrite native libraries if the library performs writes there.

4. Post-Exploitation Impact: Once the malicious payload is placed, the attacker needs to trigger its execution. For a DEX payload, the attacker may force the victim app to load the injected class at runtime (e.g., by completing an in-app workflow that invokes a dynamic class loader or by restarting the app). For a JavaScript bundle replacement, the attacker overwrites the main JS bundle file and then coerces the app to reload it (e.g., via a feature that fetches remote updates or on the next app launch). Successful execution grants the attacker arbitrary code execution in the app's context, enabling data theft (credentials, session tokens, corporate documents), communication with C2 servers, or pivoting to other apps on the device via exposed intents or shared resources.

Impact Assessment

The vulnerability carries a CVSS base score of N/A in the NVD dataset, which is atypical and likely reflects incomplete scoring metadata. Based on the vulnerability class and local attack vector, a realistic score would fall in the Medium-to-High range (4.0–7.9), considering the requirement for local access, but the high confidentiality and integrity impact once exploited.

Business Impact: Organizations relying on React Native applications for internal workflows, customer-facing services, or BYOD deployments face a significant risk. Exploitation may result in the compromise of sensitive corporate data, access tokens, and user credentials, leading to broader account takeover or data breaches. For mobile app development teams, the affected library's widespread use across thousands of applications amplifies the potential blast radius within a single enterprise's application portfolio.

Affected Systems: All React Native applications integrating react-native-document-picker versions prior to 9.1.1 on Android devices. iOS implementations are not affected as the vulnerability is specific to the Android library component. The risk is higher on Android devices running versions below 10 (API 29) where scoped storage enforcement is weaker and file path access is more permissive for malicious apps.

Blast Radius: Although the attack is local, in a mobile enterprise environment (remote work, BYOD), the compromise of one app can cascade to other applications sharing the device, especially if they use similar file handling mechanisms or if the attacker can leverage the same traversal to read sensitive system files. The integrity impact extends to potential tampering with the application's behavior, causing reputation damage and compliance violations under frameworks like GDPR or HIPAA if personal or healthcare data is exfiltrated.

Detection Guidance

Sigma Rule

title: React Native Document Picker Directory Traversal Attempt
id: 3f6b8d2e-6c34-4a5f-9a2c-b7f8d1e4c5a6
status: experimental
description: Detects file paths with traversal sequences in Android activity results related to React Native Document Picker operations.
author: Valters IT Security Research
date: 2024/03/15
tags:
    - attack.tactic.execution
    - attack.tactic.collection
    - attack.technique.t1005
logsource:
    category: application
    product: android
    definition: 'Requires instrumentation of file I/O operations or activity result handlers on the Android endpoint.'
detection:
    selection:
        EventID: 4663  # File access attempt
        ObjectName|contains:
            - '..\\'
            - '..'
        ProcessName|contains:
            - 'react-native'
            - 'document-picker'
    condition: selection
falsepositives:
    - Legitimate file managers that use .. in user-selected paths (rare)
level: high

YARA Rule

rule Android_DocumentPicker_Traversal_Attempt
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects Android code or APK artifacts containing path traversal strings targeting React Native Document Picker library"
        date = "2024-03-15"
        reference = "CVE-2024-25466"
        severity = "high"
    strings:
        $s1 = "react-native-document-picker" ascii wide nocase
        $s2 = "content://" ascii wide
        $s3 = "file:///data/data/" ascii wide
        $s4 = "..%2f" ascii wide
        $s5 = "..\\" ascii wide
        $s6 = "document-picker" ascii wide nocase
        $s7 = "../../../" ascii wide
    condition:
        uint16(0) == 0x4B50 and (  // PK zip marker (APK file)
            ($s1 and $s2) or
            ($s1 and $s3 and $s7) or
            ($s6 and $s4) or
            ($s6 and $s7 and $s3)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-25466 - React Native Document Picker Directory Traversal via HTTP URI Manipulation"; flow:established,to_client; content:"file:///data/data/"; http.uri; content:"../"; http.uri; distance:0; metadata:attack_target Android, cve CVE-2024-25466, tag traversal, tag document-picker; reference:cve,2024-25466; classtype:attempted-user; sid:2024245; rev:1;)

Elastic Detection

// Elastic EQL query to detect file access events with traversal sequences
sequence with maxspan=5m
  [process where event.action == "file-create" or event.action == "file-write"
   and process.name : "*react-native*" or process.name : "*DocumentPicker*"
   and file.path : "*\\.\\.*" or file.path : "*..\\*"]
  [process where event.action == "open" or event.action == "read"
   and file.path : "/data/data/*" and file.path : "*..*"]

Splunk SPL Query

index=android_logs source="/var/log/android/file_access.log"
| where match(file_path, "(\.\./){1,}") OR match(file_path, "(\.\.\\){1,}")
| where process_name IN ("*react-native*", "*DocumentPicker*", "*document_picker*")
| table _time, process_name, file_path, user_id, device_id
| sort - _time

Wazuh OSSEC Rule

<rule id="100245" level="12">
  <decoded_as>json</decoded_as>
  <field name="file_path">\.\./</field>
  <field name="process_name">react-native|DocumentPicker</field>
  <description>CVE-2024-25466 - Directory traversal attempt in React Native Document Picker on Android</description>
  <group>android,traversal,cve-2024-25466,</group>
  <mitre>
    <id>T1005</id>
  </mitre>
  <options>no_full_log</options>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed).

The NVD description explicitly states the vulnerability is "fixed in v9.1.1," confirming that a patched version exists. However, the patch has not been independently verified by a second source, and the listed Patch Sources array is empty. Exercise caution and verify the fix by reviewing the library's changelog and release notes for version 9.1.1.

1. Immediate Mitigations:

   • Upgrade Immediately: Update react-native-document-picker to version 9.1.1 or later in all React Native projects. The package is distributed via npm. Run the following command in your project root:

     npm install react-native-document-picker@9.1.1
     

     After installation, rebuild the Android application and redeploy via your mobile app management (MAM) policy.
   • Android Permission Review: Audit the AndroidManifest.xml of applications using the vulnerable library. Ensure that the app does not export any Activity or ContentProvider that could be abused by malicious apps to control the document picker flow.
   • Local Threat Monitoring: Deploy mobile device management (MDM) policies that restrict sideloading of third-party applications on corporate-managed devices, reducing the attack surface for malicious apps that would trigger the traversal.

2. Patch/Upgrade Steps:

   • Dependency Check: Run npm audit or use a software composition analysis (SCA) tool to identify all projects using the vulnerable version.
   • Upgrade and Test: After updating the package, rebuild the Android APK. Perform regression testing on the document picker feature to ensure the patch does not break compatibility with Android's scoped storage implementation on API 29+.
   • Verify the Patch: Inspect the diff in the upstream GitHub repository between the version you were using and 9.1.1. Look for changes in the android/src/main/java directory that introduce path canonicalization checks (e.g., using File.getCanonicalPath() or Path.normalize()).
   • Independent Validation: If possible, conduct a manual penetration test with a crafted malicious app to confirm the traversal is mitigated in your build.

3. Long-Term Hardening:

   • Static Analysis Integration: Add a custom lint rule or use commercial tools to flag usage of raw file:// URI handling in your React Native codebase.
   • Input Validation Layer: Wrap the Document Picker API in your own abstraction layer that validates the returned URI scheme (deny file://, allow only content://) and rejects any URI containing traversal sequences or non-standard host values.
   • Android Scoped Storage Compliance: Ensure your target Android SDK is set to API 29 or higher, which enforces scoped storage for apps targeting those versions, and verify the Document Picker library uses the modern MediaStore or FileProvider APIs instead of raw file paths.
   • Continuous Monitoring: Subscribe to the library's GitHub repository releases to receive notifications for security patches and update your dependencies proactively.

References

1. NVD Entry for CVE-2024-25466: https://nvd.nist.gov/vuln/detail/CVE-2024-25466
2. React Native Document Picker GitHub Repository (Check the release notes for v9.1.1): https://github.com/rnmods/react-native-document-picker
3. OWASP Mobile Application Security Testing Guide (MASTG) – File handling and path traversal testing: https://owasp.org/www-project-mobile-security-testing-guide/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2024-25466 is NOT listed as of this report's date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK Technique T1005 – Data from Local System: https://attack.mitre.org/techniques/T1005/

Threat Actor Activity: As of this writing, there is no documented evidence of exploitation in the wild, and no threat actor group has been publicly attributed to leveraging CVE-2024-25466. However, given the prevalence of React Native in enterprise mobile applications, it is prudent to assume opportunistic attackers will weaponize this flaw in the near term, especially as technical details become more widely circulated. Monitor the library's issue tracker and public security advisories for updates on active exploitation indicators.