CVE-2020-5764 in MX Player App
Summary
by MITRE
MX Player Android App versions prior to v1.24.5, are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in "Receive" mode. An attacker can exploit this by connecting to the MX Transfer session as a "sender" and sending a MessageType of "FILE_LIST" with a "name" field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone, but being saved outside of the intended "/sdcard/MXshare" directory. In some instances, an attacker can achieve remote code execution by writing ".odex" and ".vdex" files in the "oat" directory of the MX Player application.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/09/2020
The vulnerability identified as CVE-2020-5764 represents a critical directory traversal flaw in the MX Player Android application affecting versions prior to v1.24.5. This security weakness specifically manifests within the MX Transfer feature when operating in "Receive" mode, creating a pathway for malicious actors to manipulate file storage locations on affected devices. The vulnerability stems from inadequate input validation mechanisms that fail to properly sanitize file paths received during transfer operations, allowing attackers to exploit the system through crafted file listings.
The technical exploitation of this vulnerability occurs through a carefully constructed attack vector involving the MX Transfer protocol's MessageType "FILE_LIST" functionality. When an attacker assumes the role of a "sender" and crafts a malicious payload containing directory traversal sequences using "../" characters in the "name" field, the application processes these paths without proper sanitization. This flaw allows the malicious files to be transferred to the victim's device but saved outside the intended "/sdcard/MXshare" directory structure, effectively bypassing the application's designated storage boundaries. The vulnerability operates at the file system level, leveraging the application's trust in user-provided file paths without sufficient validation.
The operational impact of this vulnerability extends beyond simple unauthorized file placement, as it can potentially enable remote code execution under specific conditions. When attackers successfully manipulate the file transfer process to write malicious files in the "oat" directory of the MX Player application, they can leverage the Android application runtime environment to execute arbitrary code. This particular threat vector aligns with common attack patterns documented in the ATT&CK framework under application deployment and privilege escalation techniques. The ability to write ".odex" and ".vdex" files in the oat directory represents a sophisticated exploitation method that can lead to complete system compromise, as these files are essential components of Android's runtime optimization system.
The root cause of this vulnerability maps directly to CWE-22, which describes "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", a well-documented weakness in software security practices. This classification indicates that the application failed to implement proper input validation and path sanitization mechanisms that should prevent attackers from manipulating file system paths through crafted input data. The vulnerability demonstrates a fundamental flaw in the application's security architecture where user-controllable data enters critical system operations without adequate protection. Organizations and security professionals should recognize this as a classic example of insufficient input sanitization that can lead to severe consequences in mobile application environments.
Mitigation strategies for this vulnerability require immediate application updates to version 1.24.5 or later, which includes proper path validation and sanitization mechanisms. System administrators and security teams should implement network monitoring to detect suspicious MX Transfer activities and establish network segmentation to limit exposure. Additionally, mobile device management policies should enforce application updates and restrict file transfer capabilities where possible. The remediation process should include comprehensive security testing of file handling operations and implementation of proper input validation controls. Organizations should also consider deploying endpoint protection solutions that can detect and block malicious file transfer activities, particularly those involving directory traversal patterns. Regular security audits of mobile applications should be conducted to identify similar vulnerabilities in other software components that may present analogous security risks.