Executive brief
The Xiaomi Galaxy FDS Android SDK, used by mobile applications to interact with Xiaomi's cloud storage services, fails to verify the identity of the servers it connects to. This flaw allows an attacker positioned on the same network (such as public Wi-Fi) to intercept or modify data sent between the app and the cloud. This could lead to the theft of user files, login credentials, and sensitive API data.
Technical details
The Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) through version 3.0.8 improperly validates TLS certificates. Specifically, in the GalaxyFDSClientImpl.createHttpClient() method, the SDK configures the Apache HttpClient with SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER. This configuration accepts any valid certificate even if the hostname does not match the requested endpoint. A network-positioned attacker can perform a man-in-the-middle (MITM) attack to intercept and modify traffic to Xiaomi FDS cloud storage. The project is currently end-of-life (EOL), and no official patch is expected.
Affected products
- Xiaomi Galaxy FDS Android SDK 3.0.8 and prior
Timeline
- 2026-02-12: disclosed
- 2026-02-12: advisory