CVE-2024-45353

Executive Summary

CVE-2024-45353 is an intent redirection vulnerability in the Xiaomi Quick App Framework. The vulnerability arises from improper input validation, allowing an attacker to redirect intents to unintended components. This can lead to unauthorized actions within the Xiaomi ecosystem, such as launching arbitrary activities or accessing sensitive data. The CVSS score is 4.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood currently. No public proof-of-concept or patch is available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary component of the Xiaomi Quick App Framework, which is part of the MIUI operating system. Supply chain risks are limited to Xiaomi's internal development and distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement for user interaction and the limited impact on confidentiality. However, intent redirection can be chained with other vulnerabilities for more severe attacks.

Deep Dive & Mechanics

The Xiaomi Quick App Framework allows developers to create lightweight applications that run within the MIUI environment. Intent redirection occurs when an application improperly validates the target of an intent, allowing an attacker to craft a malicious intent that is redirected to a different component than intended.

Mechanism:

1. The vulnerable component receives an intent from an external source (e.g., a malicious app or web page).
2. The component fails to validate the intent's target (e.g., package name, class name, or action).
3. The intent is forwarded to a different component, potentially one with higher privileges or access to sensitive data.
4. The attacker can then trigger actions such as launching arbitrary activities, accessing private data, or performing unauthorized operations.

Attack Scenario:

• An attacker creates a malicious app that sends a crafted intent to the Xiaomi Quick App Framework.
• The framework redirects the intent to a system component, such as the Settings app, allowing the attacker to modify device settings without user consent.
• Alternatively, the attacker could redirect the intent to a component that exposes sensitive user data.

Vulnerable vs. Patched Code

No patch is available, and the vulnerable code is proprietary. However, the general pattern of intent redirection vulnerabilities is well-known.

Vulnerable Code (Conceptual):

// Vulnerable: No validation of target component
Intent receivedIntent = getIntent();
String action = receivedIntent.getAction();
Intent redirectIntent = new Intent(action);
startActivity(redirectIntent);

Patched Code (Conceptual):

// Patched: Validate target component
Intent receivedIntent = getIntent();
String action = receivedIntent.getAction();
if (isValidAction(action)) {
    Intent redirectIntent = new Intent(action);
    redirectIntent.setPackage("com.xiaomi.trusted.package");
    startActivity(redirectIntent);
} else {
    // Log or reject
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Xiaomi device with MIUI and Quick App Framework installed.
• A malicious Android application or web page capable of sending intents.

Exploitation Steps:

1. Create a malicious Android app that sends an intent with a crafted action or data URI.
2. Use the startActivity() method to send the intent to the Xiaomi Quick App Framework.
3. The framework redirects the intent to a target component (e.g., com.android.settings).
4. Observe the unauthorized action (e.g., opening a specific settings page).

Example Malicious Intent:

Intent intent = new Intent();
intent.setAction("com.xiaomi.quickapp.action.REDIRECT");
intent.putExtra("target", "com.android.settings");
startActivity(intent);

Blue Team

Detection:

• Monitor for unusual intent patterns in system logs.
• Use static analysis to identify apps that send intents to the Quick App Framework.
• Implement runtime checks for intent redirection.

Mitigation:

• Apply input validation on all incoming intents.
• Restrict the components that can be targeted by intents.
• Use setPackage() to limit intent delivery to trusted packages.

Indicators of Compromise (IOCs)

• Log Entries: Intent redirection detected: action=<action>, target=<component>
• Network Traffic: Unusual outbound connections from the Quick App Framework.
• File System: Modified configuration files in /data/data/com.xiaomi.quickapp/.
• Process: Unexpected child processes spawned by the Quick App Framework.

Detection Engineering

YARA Rule

rule CVE_2024_45353_Intent_Redirection {
    meta:
        description = "Detects intent redirection patterns in Xiaomi Quick App Framework"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-45353"
    strings:
        $s1 = "com.xiaomi.quickapp" ascii wide nocase
        $s2 = "intent" ascii wide nocase
        $s3 = "redirect" ascii wide nocase
        $s4 = "startActivity" ascii wide nocase
    condition:
        all of ($s*) and filesize < 1MB
}

Sigma Rule

title: Intent Redirection via Xiaomi Quick App Framework
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects intent redirection attempts targeting Xiaomi Quick App Framework
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        - 'Intent redirection detected'
        - 'com.xiaomi.quickapp'
    condition: selection
falsepositives:
    - Legitimate app interactions
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-45353 Intent Redirection Attempt"; content:"com.xiaomi.quickapp"; content:"intent"; content:"redirect"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Quick App Framework if not needed.
2. Restrict app permissions to prevent malicious apps from sending intents.
3. Monitor for suspicious intent activity.

Long-term Fix:

• Apply input validation on all intents received by the Quick App Framework.
• Use setPackage() to restrict intent delivery to trusted components.
• Implement a whitelist of allowed target components.

Vendor Status:

• No patch is available from Xiaomi as of this report. Users should monitor Xiaomi's security advisories for updates.

Valters IT
Securing Digital Ecosystems