Google Android 11.0/12.0/13.0 FileUtils.java extractRelativePath path traversal

Summaryinfo

A vulnerability described as critical has been identified in Google Android 11.0/12.0/13.0. Affected is the function extractRelativePath of the file FileUtils.java. The manipulation results in path traversal. This vulnerability is identified as CVE-2023-21093. The attack is only possible with local access. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Google Android 11.0/12.0/13.0 (Smartphone Operating System). It has been classified as critical. Affected is the function extractRelativePath of the file FileUtils.java. The manipulation with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-228450832

The weakness was released 04/20/2023 as A-228450832. The advisory is shared for download at source.android.com. This vulnerability is traded as CVE-2023-21093 since 11/03/2022. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/10/2025). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1006.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at EUVD (EUVD-2023-25261) and CERT Bund (WID-SEC-2023-0841). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Samsung Exynos
• Samsung Android

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 11.0
• 12.0
• 13.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion