DEF CON 32 - Xiaomi The Money : Our Toronto Pwn2Own Exploit & BTS Story - Ken Gannon, Ilyes Beghdadi

The team successfully exploited a zero-day vulnerability in the Xiaomi 13 Pro’s Get Apps app via a web view XSS to achieve remote code execution, ultimately succeeding in Spain due to region-specific app availability 1:58.

Key Takeaways:
• The exploit used a web view XSS in Get Apps to inject malicious JavaScript, bypassing input sanitization in the integral_dialog_page.chunk.js file 13:00.
• A JavaScript interface allowed execution of the install and openApp functions, enabling force-installation of any app without user consent 9:00.
• The attack chain was completed by installing a reskinned Drozer app (Sunfish) and establishing a bind shell, achieving full remote code execution 18:00.
• The exploit worked only in Spain, where the Opera browser was enabled and the app store was not yet launched, while failing in the Philippines, Canada, and the US due to region-specific restrictions 33:00.
• Xiaomi patched the vulnerability by removing the exploited file from the app, blocking app installations, and adding browser restrictions, leading to a failed attack during the competition 36:00.

Xiaomi’s aggressive patching and lack of vendor acknowledgment resulted in no CVE credit for the team, highlighting poor vendor response. 38:00

Sources:

• 1:58 Overview of the exploit chain and Pwn2Own context.
• 9:00 Description of the web view XSS vulnerability and exploit flow.
• 13:00 Details on the XSS payload by