20 security issues found in Xiaomi devices

What it is

Oversecured's April 2023 report of 20 vulnerabilities in Xiaomi apps and system components, found by its scanner and reported to Xiaomi between 25 and 30 April 2023. The page says they were "resolved", but it gives no fixed versions, CVE ids or dates. Each entry has a short PoC. The sections below cover entries the catalog summary does not name.

How it works

The bugs fall into a few repeating classes.

Intent, broadcast and service redirection from privileged apps

• Security Core Component (com.miui.securitycore): com.miui.xspace.receiver.MediaScannerReceiver clears the intent's component but keeps its selector. Xiaomi's receiver gets the broadcast first, then it is forwarded to any receiver the attacker names, including non-exported ones. The action must be android.intent.action.MEDIA_SCANNER_SCAN_FILE or miui.intent.action.MEDIA_SCANNER_SCAN_FOLDER. The app is a system app, so it can reach receivers in any installed app.
• Settings: WifiDppEnrolleeActivity binds whatever service is named by the extras floating_service_pkg and floating_service_path. This comes from MultiAppFloatingActivitySwitcher.install() in the miuix SDK. Oversecured believes the SDK is present in many Xiaomi apps and makes them vulnerable too.
• GetApps (com.xiaomi.mipicks): the exported MainUserAgreementActivity and AppChooserActivity forward an attacker-supplied targetIntent. This reaches non-exported activities, including DebugPreferenceFragmentActivity, and UnlockActivity can act as a proxy to other apps.

Unauthenticated destructive or injectable actions

• Security Core Component: a dynamically registered receiver in SecondSpaceService.java handles the action com.miui.securitycore.ACTION_TO_REMOVE_USER. Any app can send it, and it stops and deletes the current user, then locks the screen.
• GetApps: the LiveEventBus library registers an insecure receiver for intent.action.ACTION_LEB_IPC. Attacker JSON is deserialized by Gson into arbitrary classes, including ones holding native pointers, which gives memory corruption on destruction. Oversecured says it told the library's developer over a year earlier and got no fix. The PoC uses com.android.internal.util.VirtualRefBasePtr.
• Xiaomi Cloud: a dynamic receiver in ShareLocationHybridActivity concatenates the push_data extra into JavaScript run in a WebView (XSS). The app must be running so the receiver is registered.
• Print Spooler: the exported ConvertPdfAlertActivity builds an output path from the provider-controlled _display_name. Using ../../ gives an arbitrary file write or overwrite.

File access

• MIUI Bluetooth (com.xiaomi.bluetooth): the exported HeadsetProvider does not validate the resulting File, so path traversal reads arbitrary files. It runs under android.uid.bluetooth. The PoC reads /sdcard/test.txt.
• Settings MiuiFastConnectResourceProvider: the checks endsWith(".zip") and !contains("../") are bypassed with %2F encoding and a #.zip fragment. The PoC reads settings_secure.xml.

Data leaks through implicit intents

• Settings broadcasts leak Bluetooth devices, connected Wi-Fi networks and emergency contacts. Settings activity intents also leak Xiaomi account details and phone numbers.
• MIUI Bluetooth broadcasts leak connected device data without requiring android.permission.BLUETOOTH.
• Phone Services intents leak the ICCID and IMSI of virtual SIMs.
• GetApps intents (com.xiaomi.global.payment.MI_PAYMETHOD, MI_ORDERSLIST) leak Xiaomi session tokens.
• Mi Video broadcasts leak the user's name and email.
• Gallery: an implicit avatar-picker intent can be intercepted. It also grants read URI permission to any handler of com.android.camera.action.CROP, so an attacker app can read arbitrary content providers. The PoC dumps contacts. Oversecured says the pattern appears in several Xiaomi apps.

Crypto

• ShareMe (com.xiaomi.midrop) encrypts private-file metadata in /sdcard/ShareMe/safebox/ with DES and a hardcoded key, miuiMidrop. The page includes the decrypt routine.

Preconditions / Affected

Every PoC is an attacker app installed on the same device. Several entries are worse because the target is a system app (android.uid.system for Security, system-privileged Settings). The page names no device models or MIUI versions.

What to do

The page states no patch versions or update instructions. A defender can check the defect classes it shows:

• Audit exported components that forward a caller-supplied Intent, selector or component name.
• Audit providers that build file paths from URIs or _display_name.
• Audit sensitive data sent in implicit intents.
• Audit hardcoded keys.

Caveats

The fetched text was cut at about 60,000 of 60,983 characters, in the Mi Video entry. Its PoC and anything after it were not seen, so the 20-item count cannot be checked against the text read. The page labels some entries with package names that look inconsistent: Xiaomi Cloud and the GetApps token entry. Whether every issue is fixed, and in which builds, is not stated.