Dirty Stream Android Flaw Let Malicious Apps Overwrite Private Files

Microsoft disclosed "Dirty Stream", a path traversal-related vulnerability pattern in Android apps that accept shared files from other apps and trust filenames supplied by remote content providers. The flaw can let a malicious app overwrite files inside a target app’s private directory, creating paths to arbitrary code execution, theft of authentication tokens, and exposure of other sensitive data. Microsoft said the issue affected multiple popular Google Play apps with a combined install base exceeding 4 billion.

Microsoft highlighted vulnerable apps including Xiaomi File Manager and WPS Office, and demonstrated code execution in Xiaomi File Manager. The company said exploitation could also expose stored SMB and FTP credentials and enable access to local network shares beyond the device itself. Microsoft coordinated fixes with affected developers by February 2024 and worked with Google on developer guidance for safer Android file-sharing implementations, reinforcing the need for apps handling shared content to validate filenames and file paths before writing data.