CVE-2024-43093
Android Framework Privilege Escalation Vulnerability
Description
CVE-2024-43093 is a high-severity local privilege escalation vulnerability in the Android Framework component, specifically in the shouldHideDocument method of ExternalStorageProvider.java. Rated 7.3 on the CVSS v3.1 scale, the vulnerability allows an attacker with low privileges and user interaction to bypass a file path filter through incorrect Unicode normalization, gaining unauthorized access to sensitive directories. Affecting Android versions 12.0 through 15.0, this vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024. The EPSS score is 0.00115 (30.3rd percentile), suggesting targeted rather than widespread exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| android | 12.0; 12.1; 13.0; 14.0; 15.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://android.googlesource.com/platform/frameworks/base/+/7f83c671626f9bf993581f4598c22482d87cba10(Patch)
- https://source.android.com/security/bulletin/2025-03-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-43093(Third Party Advisory, US Government Resource)
Weakness Type
The specific CWE for CVE-2024-43093 has not been formally assigned. However, the vulnerability is functionally related to incorrect Unicode normalization — a class of weakness where different Unicode representations of the same character bypass string comparison logic. In this case, the shouldHideDocument function in ExternalStorageProvider.java implements a file path filter designed to prevent access to sensitive directories. However, by using Unicode characters that normalize to the expected path separators or directory names, an attacker can craft file paths that pass the filter check but resolve to protected directories at the filesystem level. This type of Unicode normalization bypass has been a recurring attack pattern in path traversal and access control scenarios across multiple platforms.
Impact Analysis
The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that CVE-2024-43093 requires local access and low privileges but delivers high impact across confidentiality, integrity, and availability. The user interaction requirement means the victim must perform some action, such as opening a malicious file or using a crafted file picker intent, to trigger the vulnerability. Business impact centers on the ability to access sensitive directories that Android's storage access framework is designed to protect. This includes system configuration files, application private data, and potentially credential storage. On enterprise-managed devices, this could expose corporate data, VPN configurations, and authentication tokens. The relatively low EPSS score of 0.00115 (30.3rd percentile) combined with KEV listing suggests this vulnerability is being used in targeted attacks rather than mass exploitation campaigns — a pattern consistent with sophisticated mobile threat actors and spyware operations. The broad range of affected Android versions (12.0 through 15.0) means the vulnerability impacts the vast majority of active Android devices worldwide.
Exploit Maturity
CVE-2024-43093 is confirmed as actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 28, 2024. The ransomware association is classified as "Unknown." Despite the relatively low EPSS score of 0.00115 (30.3rd percentile), the KEV listing confirms real-world exploitation, likely in targeted attacks against specific individuals or organizations. The patch is available on the Android Open Source Project repository. The exploit requires a locally installed malicious application to craft the Unicode-based path bypass, which is consistent with spyware deployment patterns where the attacker has already achieved initial code execution on the device through a separate vector such as a malicious app or another exploit chain.
Remediation
- Apply the Android security update from the March 2025 bulletin — Install the latest security patch level as documented in the Android Security Bulletin, ensuring your device is updated to the patch level that addresses this vulnerability.
- Enable automatic security updates — Configure Android devices to automatically download and install security updates to minimize the window of exposure for future vulnerabilities.
- Audit installed applications — Review installed applications for any unfamiliar or suspicious apps that could serve as the local attack vector. Remove applications from untrusted sources and restrict side-loading through device management policies.
- Deploy mobile device management (MDM) — For enterprise environments, use MDM solutions to enforce security patch compliance, restrict app installations to approved sources, and monitor devices for indicators of compromise.
- Restrict storage access permissions — Review and minimize the storage access permissions granted to applications. Android's scoped storage model in newer versions provides better isolation, but legacy apps may still have broad access.
Technical Details
The CVSS v3.1 vector for CVE-2024-43093 is CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, yielding a base score of 7.3 (High). Attack Vector (Local) means the attacker needs to execute code on the device, typically through a malicious application. Attack Complexity (Low) confirms the Unicode normalization bypass is reliable and does not require special conditions. Privileges Required (Low) indicates a standard app with basic permissions can trigger the vulnerability. User Interaction (Required) means the victim must perform an action such as using a file picker or opening a crafted intent. Scope (Unchanged) keeps the impact within the Android Framework's security context. Confidentiality, Integrity, and Availability (all High) reflect the ability to read, modify, and potentially destroy data in protected directories. The technical mechanism targets the shouldHideDocument method in ExternalStorageProvider.java, which maintains a list of directory paths that should be hidden from external access. The path comparison logic does not account for Unicode normalization equivalences, so an attacker can construct a path using Unicode characters that are visually or functionally equivalent to the filtered characters but do not match the string comparison. When the filesystem resolves the path, the Unicode characters normalize to the protected directory path, granting unauthorized access.
Frequently Asked Questions
What is CVE-2024-43093?
CVE-2024-43093 is a privilege escalation vulnerability in Android's Framework component that allows a locally installed application to bypass file path filters through Unicode normalization tricks. This grants unauthorized access to sensitive directories on the device that should be protected by Android's storage access controls.
Which Android versions are affected by CVE-2024-43093?
Android versions 12.0, 12.1, 13.0, 14.0, and 15.0 are all affected. This covers the vast majority of Android devices currently in active use, making the potential impact extremely broad.
Is CVE-2024-43093 being used in targeted attacks?
Yes, CISA has confirmed active exploitation and added this vulnerability to its KEV catalog. The low EPSS score combined with KEV listing suggests targeted exploitation, consistent with spyware or surveillance campaigns rather than mass automated attacks.
How do I protect my Android device from CVE-2024-43093?
Install the latest Android security update from the March 2025 security bulletin. Enable automatic updates, only install apps from trusted sources like the Google Play Store, and review the permissions granted to installed applications. Enterprise users should ensure their MDM solution enforces patch compliance.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.