With more than 100,000,000 downloads ES File Explorer is one of the most famous #Android file manager.
The surprise is: if you opened the app at least once, anyone connected to the same local network can remotely get a file from your phone
Conversation
Technically, everytime a user is launching the app, a HTTP server is started. This server is opening locally the port 59777. On this port, an attacker can send a JSON payload to the target
11
86
207
You can find the proof of concept on this Github repo
4
60
215
To sum up, an attacker connected on the same local network can remotely:
- get a file from your phone
- list all the apps installed on your phone
- list all your videos, images, audio files
7
51
164
Worth to say, I'm convinced this "feature" has been implemented by design. Imagine a scenario: I'm Chinese, I have ES File Explorer installed on my phone. I'm on the subway and I used to connect to the public wifi. "The authorities" can use this "feature" against me.
GIF
7
46
211
As always, excellent article by
5
73
232
I did a commit to fix a small issue on my script. If you have a problem with the script or have some improvements don't hesitate to contact me or to send a pull request!
7
21
99
I love the #infosec community! The awesome found that ES File Explorer is vulnerable to a MITM attack 😅
Quote Tweet
Thanks to @fs0c131y research, I found another local vulnerability in ES File Explorer app: Man-in-the-middle attack. #MITM
Attacker connected to the same local network can intercept HTTP traffic and exchange it for his own.
youtu.be/BtLUO-ujJ7I
Show this thread
1
22
121
Did I tell you that I found 2 others vulnerabilities in ES File Explorer? But I will keep them for another day
8
13
132
You are awesome! I already merged 4 pull requests. Thank you all for your contribution and show me how bad I am in Python 😁
3
3
52
Quote Tweet
UPDATE: ES File Explorer stated "We have fixed the http vulnerability issue and released it. Waiting for the Google market to pass the review." twitter.com/fs0c131y/statu…Show this thread
2
3
21
Quote Tweet
UPDATE: ES File Explorer developers: "We would also like to thank Baptiste Robert for bringing this vulnerability to our attention so we can continue to provide a safe and secure online environment for all of our users"
GIF
4
3
44
