PT-2022-13043 · Unknown · Skylot/Jadx

Published 2022-01-20 · Updated 2022-01-26 · CVE-2022-0219

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions skylot/jadx versions prior to 1.3.2

Description The issue is related to an improper restriction of XML external entity references. This can be exploited when a user is tricked into exporting a malicious APK file, containing a crafted AndroidManifest.xml or strings.xml, to gradle. This could lead to possible local file disclosure.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the -e option when exporting APK files to prevent potential exploitation. Restrict access to sensitive files and directories to minimize the risk of local file disclosure.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-0219

GHSA-R8J4-96MX-RJCC

Affected Products

Skylot/Jadx

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0219.json · Exploit
• 🔥 https://huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e · Exploit
• https://github.com/skylot/jadx/commit/d22db30166e7cb369d72be41382bb63ac8b81c52 · Patch
• https://osv.dev/vulnerability/CVE-2022-0219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0219 · Security Note
• https://osv.dev/vulnerability/GHSA-r8j4-96mx-rjcc · Vendor Advisory
• https://github.com/skylot/jadx · Note
• https://t.me/cybersecuritytechnologies/5254 · Telegram Post
• https://t.me/cibsecurity/35943 · Telegram Post