Xiangqian Zhang - Bugfinding & Exploit Techniques in Android File Transfer Apps

Android File Transfer App Vulnerabilities

Xiangqian Zhang presents research discovering critical vulnerabilities in popular Android file transfer applications used by hundreds of millions of users — apps that create local Wi-Fi servers for cross-device file sharing.

Target Application Category

Apps like Xender, SHAREit, and AirDroid create local HTTP/FTP servers on the Android device's Wi-Fi interface to enable cross-device file transfers. These applications typically run with broad file system permissions to access all device storage.

Vulnerability Discovery

Combining automated fuzzing of the HTTP server component with manual code review, Zhang discovers: unauthenticated arbitrary file read (exposing all device storage), path traversal in upload endpoints enabling arbitrary file write, and code execution via malicious APK delivery through the transfer channel.

Exploit Chains

Zhang demonstrates a complete attack chain from a malicious Wi-Fi hotspot: victim connects to the AP, attacker exploits the file transfer server to install a malicious APK silently, achieving full device compromise against apps with hundreds of millions of installs.