CVE-2019-6447

Description

The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network. This TCP port remains open after the ES application has been launched once, and responds to unauthenticated application/json data over HTTP.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

ES File Explorer Open Port
auxiliary/scanner/http/es_file_explorer_open_port

Exploit-DB 1

ES File Explorer 4.1.9.7.4 - Arbitrary File Read EDB-50070 · remote · Jun 29, 2021

GitHub 13 repositories · most starred shown

fs0c131y/ESFileExplorerOpenPortVuln ★ 683 · Jan 9, 2019

ES File Explorer Open Port Vulnerability - CVE-2019-6447
Chethine/EsFileExplorer-CVE-2019-6447 ★ 3 · Jul 8, 2022

Exploiting Android Vulnerability in ES File Explorer
vino-theva/CVE-2019-6447 ★ 0 · Aug 2, 2022

This paper is about manual exploitation of android open port vulnerability found in ES file manager. This open TCP 59777 port allows the attacker to install a backdoor and gather all the user’s data.…
Osuni-99/CVE-2019-6447 ★ 0 · Jul 3, 2022

The above investigation of the ES file browser security weakness allows us to see the issue in its entirety
VinuKalana/CVE-2019-6447-Android-Vulnerability-in-ES-File-Explorer ★ 0 · Jun 15, 2022

This repository is developed to understand CVE-2019-6447
Kayky-cmd/CVE-2019-6447--. ★ 0 · Feb 3, 2022
febinrev/CVE-2019-6447-ESfile-explorer-exploit ★ 0 · Oct 7, 2021

ES File Explorer v4.1.9.7.4 Open port vulnerability exploit. CVE-2019-6447
julio-cfa/POC-ES-File-Explorer-CVE-2019-6447 ★ 0 · Aug 8, 2021

Very basic bash script to exploit the CVE-2019-6447.
h3x0v3rl0rd/CVE-2019-6447 ★ 0 · Jul 9, 2021
SandaRuFdo/ES-File-Explorer-Open-Port-Vulnerability---CVE-2019-6447 ★ 0 · May 14, 2020

ES File Explorer Open Port Vulnerability - CVE-2019-6447

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute appl…