PT-2024-1051 · Apktool+1 · Apktool+1

0X33C0Unt

·

Published

2024-01-03

·

Updated

2024-12-12

·

CVE-2024-21633

CVSS v3.1

7.8

High

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apktool versions 2.9.1 and prior
Description The issue is related to incorrect restriction of the directory path name with limited access. An attacker can exploit this to write or overwrite arbitrary data. Apktool infers resource files' output path according to their resource names, which can be manipulated by an attacker to place files at a desired location on the system Apktool runs on. Affected environments are those in which an attacker may write or overwrite any file that the user has write access to, and either the user name is known or the current working directory is under the user folder.
Recommendations For versions 2.9.1 and prior, apply the patch from commit d348c43b24a9de350ff6e5bd610545a10c1fc712 to resolve the issue. As a temporary workaround, consider restricting write access to sensitive files and directories to minimize the risk of exploitation. Avoid using Apktool in environments where an attacker may have write access to critical files or directories until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-00277
CVE-2024-21633
GHSA-2HQV-2XV4-5H5W

Affected Products

Apktool
Debian