The researcher Robert Baptiste with alias Elliot Alderson disclosed his findings in a tweet last week.
https://twitter.com/fs0c131y/status/1085460755313508352
- fs0c131y
As revealed, ES File Explorer had an HTTP server running in the background that opened upon launching the app every session. The server could continue to run even after closing the app unless the user deliberately cleared all background services of the app. He also shared the detailed PoC of the flaw (CVE-2019-6447) on Github, where he described,
“Every time a user is launching the app, a HTTP server is started. This server is opening locally the port 59777. On this port, an attacker can send a JSON payload to the target. These commands allow an attacker connected on the same local network to the victim, to obtain a lot of juicy information (device info, app installed, ...) about the victim's phone, remotely get a file from the victim's phone and remotely launch an app on the victim's phone.”After this discovery, another researcher Lukas Stefanko pointed out another flaw. This one made the devices vulnerable to man-in-the-middle (MITM) attacks. As described,
“Attacker has to be connected to the same network as the victim (Starbucks, coffee shop, public wifi...) to intercept victim's traffic. App uses instead of secured HTTPS protocol HTTP that could be controlled by adversary if on same local network.”He demonstrated the problem in a video.
The vulnerability affected all app versions up to 4.1.9.7.4. The recently patched version available online is ES File Explorer v4.1.9.9, where they have confirmed fixing the “HTTP vulnerability in LAN”. The users of this app should, hence, make sure to upgrade their app versions at the earliest to stay protected.
