CVE-2024-43093: Android Framework ExternalStorageProvider Path Filter Bypass Vulnerability
Summary
CVE-2024-43093: In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Affects platform/frameworks/base across 6 version ranges.
>= 12:0, < 12:2025-03-01
>= 12L:0, < 12L:2025-03-01
>= 13:0, < 13:2025-03-01
>= 14:0, < 14:2025-03-01
>= 15:0, < 15:2025-03-01
>= 15-next:0, < 15-next:2025-03-01
Fixed in 15-next:2025-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Android Framework is a set of APIs and tools that allow developers to create applications for the Android operating system. One of its components, the ExternalStorageProvider, manages access to external storage on devices. This provider is crucial for handling files and directories, ensuring that applications can read and write data securely. However, a vulnerability has been identified in the shouldHideDocument function, which could allow unauthorized access to sensitive directories.
Vulnerability Detail
In the shouldHideDocument function of ExternalStorageProvider.java, there exists a flaw related to incorrect Unicode normalization. This issue can lead to a bypass of a file path filter that is intended to prevent access to sensitive directories. As a result, an attacker could exploit this vulnerability to escalate privileges locally without needing additional execution privileges. User interaction is required for exploitation, making it a significant concern for device security.
How To Fix
Minimum fixed version
15-next:2025-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. Users are advised to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
The CVE-2024-43093 vulnerability poses a significant risk to Android devices by allowing unauthorized access to sensitive directories through a flaw in the ExternalStorageProvider. Users are strongly encouraged to update their systems to the latest patched versions to mitigate this risk.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2024-43093 is a vulnerability in the Android Framework's ExternalStorageProvider that allows a bypass of file path filters due to incorrect Unicode normalization.
If exploited, this vulnerability could allow unauthorized access to sensitive directories, potentially leading to local privilege escalation.
Yes, user interaction is necessary for an attacker to exploit this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor for updates and apply the patch as soon as possible to protect your device.
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
