CVE-2024-33469
Published: 11 February 2025
Summary
CVE-2024-33469 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 7.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-33469 is a vulnerability affecting Team Amaze's Amaze File Manager application in version 3.8.5, which has been addressed in version 3.10. The flaw exists in the onCreate method of DatabaseViewerActivity.java, enabling a local attacker to execute arbitrary code. It is categorized under CWE-77 (Command Injection) and carries a CVSS v3.1 base score of 7.9 (AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N), indicating high severity due to its scope change and integrity impact.
A local attacker on the affected Android device can exploit this vulnerability with low complexity, no privileges, and no user interaction required. Successful exploitation allows arbitrary code execution, resulting in high integrity impact (I:H) such as unauthorized modifications, low confidentiality impact (C:L), and no availability disruption (A:N).
Advisories recommend updating to Amaze File Manager version 3.10 to mitigate the issue. Additional details are available in the security research repository at https://github.com/blackbeard666/security-research/tree/main/CVE-2024-33469 and the Huntr bounty report at https://huntr.com/bounties/981c1cb3-d1e7-4f5c-8a24-155662d33787.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31207
Vulnerability details
An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate method of DatabaseViewerActivity.java.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local command injection in Android app directly enables client-side arbitrary code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely remediation of identified flaws, directly mitigating this CVE by updating Amaze File Manager to version 3.10 where the command injection vulnerability is fixed.
SI-10 enforces information input validation at system interfaces, preventing command injection exploits in the onCreate method of DatabaseViewerActivity by sanitizing user inputs.
SI-16 provides memory protection safeguards like address space layout randomization and data execution prevention, mitigating arbitrary code execution resulting from successful command injection.