# Android Dirty Stream Path Traversal: Detecting and Patching App Exploits

> Microsoft identifies Dirty Stream vulnerabilities in Android apps, allowing path traversal and unauthorized file manipulation. Learn how to secure your apps.

- Published: 2026-04-20T05:08:30.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Android, Dirty Stream, Path Traversal, Mobile Security, Microsoft Threat Intelligence
- Author: Runtime Rebel Intel
- Primary source: https://isc.sans.edu/diary/rss/32912
- Canonical: https://runtimerebel.com/blog/android-dirty-stream-path-traversal-detecting-and-patching-app-exploits

## Key points

- Immediate impact: Malicious apps can overwrite files in a target application's private storage potentially leading to code execution or data theft.
- Affected systems: Android applications with improper intent handling and content provider implementations including high-profile apps like Xiaomi File Manager.
- Remediation: Developers must implement strict filename validation and avoid using the DISPLAY_NAME column from external content providers for local file creation.

The Android security model relies heavily on application isolation and sandboxing. However, a significant class of vulnerabilities recently detailed by Microsoft and documented by the [SANS Internet Storm Center (ISC)](https://isc.sans.edu/diary/rss/32912) demonstrates how these boundaries can be bypassed. Known as the 'Dirty Stream' attack vector, this flaw allows a malicious application to manipulate other installed apps by exploiting improper handling of the `ContentProvider` system.

## Overview of the Dirty Stream Attack Vector

The Dirty Stream vulnerability is essentially a specialized form of path traversal. In the Android ecosystem, applications often share files using Intents and the `ContentProvider` component. When an app (the consumer) requests a file from another app (the provider), the provider typically returns a URI. The consuming app then queries this URI for metadata, such as the file's name and size, using the `OpenableColumns.DISPLAY_NAME` field.

The vulnerability occurs when the consuming application trusts this `DISPLAY_NAME` without validation. An attacker can create a malicious 'provider' app that returns a filename containing path traversal sequences, such as `../../data/data/com.target.app/files/sensitive_config.xml`. If the target app uses this name to create a local copy of the file in its own private directory, it will inadvertently overwrite its own internal data with content supplied by the attacker. This can lead to [RCE](/glossary#rce), [Privilege Escalation](/glossary#privilege-escalation), or the theft of sensitive session tokens.

## Technical Analysis: Content Providers and Path Traversal

The technical core of this [CVE](/glossary#cve) involves the manipulation of the `openFile` and `query` methods within an exported content provider. Under normal conditions, these components facilitate legitimate data sharing. However, if a developer fails to sanitize the input from the provider's cursor, they create an opening for an attacker to break out of the intended temporary directory.

This [TTP](/glossary#ttp) is particularly dangerous because it does not require a compromised device or root access. Any malicious app installed on the same device can target vulnerable high-profile applications. Research by Microsoft identified that popular applications, including Xiaomi's File Manager and WPS Office, were susceptible to this specific pattern. Microsoft's research into these issues is tracked under [CVE-2023-20951](https://nvd.nist.gov/vuln/detail/CVE-2023-20951) and [CVE-2023-20954](https://nvd.nist.gov/vuln/detail/CVE-2023-20954) for framework-level mitigations, though the fixes often require per-app updates.

### How to detect Dirty Stream vulnerabilities in Android

For security researchers and developers, identifying these flaws requires a combination of static and dynamic analysis. The primary indicator is the use of `OpenableColumns.DISPLAY_NAME` in a context where the resulting string is used as a filename for local storage. Tools like Semgrep or manual code review should focus on instances where `Cursor.getString()` is called on this specific column and subsequently passed into a `File` constructor without verification.

According to the SANS ISC analysis, a simple Python-based check can be used during a [SOC](/glossary#soc) investigation or a mobile application audit to find apps that export content providers without sufficient permission protection, which is the first step in identifying potential targets for this attack vector.

## Android Dirty Stream Path Traversal Mitigation

Defenders and developers must prioritize securing inter-process communication. The most effective **Android Dirty Stream path traversal mitigation** strategy is to ignore the filename provided by the external application entirely. Instead, the consuming app should generate a unique, random identifier for any temporary file it creates.

If the original filename must be preserved, developers must implement **content provider security best practices for Android** by sanitizing the input. This includes:

*   Stripping all path information (e.g., using `new File(name).getName()`).
*   Ensuring the resulting file path is still within the expected internal directory using the `getCanonicalPath()` method and comparing it to the intended parent directory.
*   Utilizing the [MITRE ATT&CK](/glossary#mitre-att-ck) framework to map potential data leakage points and ensuring that sensitive files are never stored in directories where they could be overwritten via an external Intent.

By following these guidelines, organizations can harden their mobile applications against this subtle but powerful class of exploitation.

**Related:** [Android Developer Identity Verification: New Google Play Mandates](/blog/android-developer-identity-verification-new-google-play-mandates), [NoVoice Android Malware on Google Play: 2.3 Million Devices Infected](/blog/novoice-android-malware-on-google-play-2-3-million-devices-infected)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/android-dirty-stream-path-traversal-detecting-and-patching-app-exploits