CVE-2019-8345 : What You Need to Know

In the ES File Explorer File Manager application 4.1.9.7.4 for Android, a vulnerability exists that allows a Man-in-the-middle attacker to conduct session hijacking on the local network due to the absence of HTTPS in the Help feature. Additionally, a malicious website can be displayed in a WebView without disclosing the URL.

Understanding CVE-2019-8345

This CVE identifies a security issue in the ES File Explorer File Manager application for Android.

What is CVE-2019-8345?

The vulnerability in the ES File Explorer File Manager application for Android allows a Man-in-the-middle attacker to perform session hijacking on the local network by exploiting the lack of HTTPS in the Help feature. Moreover, a malicious website can be shown in a WebView without revealing the URL.

The Impact of CVE-2019-8345

The vulnerability could lead to session hijacking on the local network, potentially compromising user data and privacy. It also exposes users to malicious websites without their knowledge.

Technical Details of CVE-2019-8345

This section provides more technical insights into the CVE.

Vulnerability Description

The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android lacks HTTPS, enabling a Man-in-the-middle attacker to hijack sessions on the local network. Additionally, WebView can display malicious websites without disclosing the URL.

Affected Systems and Versions

Product: ES File Explorer File Manager application 4.1.9.7.4
Vendor: N/A
Version: N/A

Exploitation Mechanism

The vulnerability can be exploited by a Man-in-the-middle attacker on the local network to intercept and manipulate user sessions. The WebView component can be abused to display harmful websites without user awareness.

Mitigation and Prevention

Protecting against and addressing the CVE.

Immediate Steps to Take

Avoid using unsecured networks where session hijacking is more likely to occur.
Consider using alternative file manager applications with better security practices.

Long-Term Security Practices

Regularly update the ES File Explorer application to patch known vulnerabilities.
Educate users on the risks of using unsecured networks and the importance of HTTPS.

Patching and Updates

Stay informed about security updates for the ES File Explorer File Manager application and apply patches promptly to mitigate the risk of session hijacking and exposure to malicious websites.