The maintainers of APKLeaks have patched a critical vulnerability that could be exploited for the remote execution of arbitrary code.
Created by Indonesia-based security engineer Dwi Siswanto, APKLeaks is open source software for scanning Android application package (APK) files for URLs, endpoints, and secrets. The application is used by FirmwareDroid, a backend solution for Android firmware analysis.
In a security advisory published on GitHub on January 21, the software’s maintainers said the security flaw “allows remote authenticated attackers to execute arbitrary OS commands via [the] package name inside application manifest”.
Escalated CVSS
The vulnerability, described as an improper neutralization of argument delimiters, is tracked as CVE-2021-21386 and has been issued a CVSS severity score of 9.3, an escalation from an original CVSS score of 7.3.
Reported by developer ‘RyotaK’ on March 19, 2021, the critical security issue surrounds a failure to protect against attackers issuing arguments that can trigger “unintended” commands, executing code remotely, or reading or tampering with sensitive information.
The advisory also notes the potential for attackers to conduct “other unintended behavior through [a] malicious package name”.
No authentication was required to exploit the vulnerability.
A patch to resolve the flaw released with APKLeaks version 2.0.3 failed to fully remedy the issue. RyotaK told The Daily Swig that the 2.0.4 patch resolved the problem correctly in the developer branch of the software, followed by v2.0.6-dev in the master branch.
The Daily Swig has reached out to the project’s developers with additional queries and we will update if and when we hear back.
Source: https://portswigger.net/daily-swig/android-security-tool-apkleaks-patches-critical-vulnerability
