Path Traversal in Flutter File Picker Android Plugin

Executive Summary

This vulnerability is a path traversal issue in the file_picker Flutter plugin for Android. It occurs because the openFileStream() method in FileUtils.kt uses a filename from ContentResolver without sanitization. A malicious app can craft a filename with ../ sequences to create files outside the intended cache directory in the victim app's internal storage.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Android apps using file_picker versions through 10.3.10 for suspicious file paths containing ../ sequences in their ContentProvider data. Check app logs for file creation attempts outside the intended cache directory. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to write arbitrary files to your app's internal storage. This might lead to data corruption, unauthorized access to sensitive data, or execution of malicious code within your app's environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized file creation outside intended directories. Malicious apps could write sensitive data to unintended locations, risking data leaks or unauthorized access. The lack of file overwriting protection means existing sensitive files remain intact but could be accessed improperly.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update file_picker to a version beyond 10.3.10. If unable to update, restrict app permissions to prevent untrusted ContentProvider access. Monitor file system for unauthorized directory creation in app storage.

Useful 0 Not Useful 0