Attack Chain

1. The victim launches the ES File Explorer application, which automatically initializes an HTTP server on TCP port 59777.
2. The attacker performs network scanning (e.g., using nmap or similar) to identify open TCP port 59777 on local network devices.
3. The attacker determines the device IP address of the target hosting the vulnerable service.
4. The attacker sends a crafted HTTP POST request to the target IP on port 59777 with a JSON body containing a command (e.g., {"command":"listFiles"}).
5. The application service executes the command without authentication, responding with the requested data.
6. The attacker iterates through specific commands (e.g., listPics, listVideos) to discover targets for exfiltration.
7. The attacker performs an HTTP GET request to a specific file path identified in the discovery phase to exfiltrate the file content.
8. The final objective is the exfiltration of sensitive user data or unauthorized control over installed applications.

Impact

Successful exploitation allows for the complete exfiltration of personal data, including photos, videos, audio recordings, and documents, from the device. Attackers can also enumerate installed applications and trigger the execution of specific apps, potentially leading to unauthorized usage or exploitation of further device-side vulnerabilities.

Recommendation

1. Identify devices within the organization's mobile fleet that have ES File Explorer (version 4.1.9.7.4 or earlier) installed.
2. Enforce mobile device management (MDM) policies to uninstall or block the usage of vulnerable versions of the application.
3. Advise users to avoid connecting mobile devices to unknown or shared public Wi-Fi networks where this vulnerability is easily reachable by malicious actors.
4. Ensure all mobile applications are updated to the latest available versions, as developers may have patched or removed the problematic management port.