CVE-2024-4405
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Xiaomi Pro 13 smartphones that allows remote code execution. Attackers can inject malicious scripts via the manual-upgrade.html file when users visit malicious pages or open malicious files. Only Xiaomi Pro 13 users are affected.
💻 Affected Systems
- Xiaomi Pro 13 smartphone
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing data theft, surveillance, ransomware deployment, and persistent backdoor installation.
Likely Case
Session hijacking, credential theft, data exfiltration, and installation of additional malware payloads.
If Mitigated
Limited to isolated browser session compromise if proper sandboxing and security controls are active.
🎯 Exploit Status
User interaction required (visiting malicious page or opening malicious file)
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-24-418/
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > About phone > System update. 2. Install any available updates. 3. Restart device after installation.
🔧 Temporary Workarounds
Disable JavaScript in Browser
allPrevents script execution in web browser
Use Alternative Browser
allUse browsers with strong XSS protection
🧯 If You Can't Patch
- Avoid clicking unknown links or opening untrusted files
- Use device in restricted mode with minimal permissions
🔍 How to Verify
Check if Vulnerable:
Check if manual-upgrade.html exists in mimarket app and test for XSS in manualUpgradeInfo parameterCheck Version:
Settings > About phone > MIUI versionVerify Fix Applied:
Verify system version is updated and test XSS payloads no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript execution in browser logs
- Suspicious file access patterns
Network Indicators:
- Connections to known malicious domains after visiting suspicious pages
SIEM Query:
Not applicable for mobile devices without enterprise monitoring