Android security tool APKLeaks patches critical vulnerability

The package flaw allowed a number of malicious activities to take place

The maintainers of APKLeaks have patched a critical vulnerability that could be exploited for the remote execution of arbitrary code.

Created by Indonesia-based security engineer Dwi Siswanto, APKLeaks is open source software for scanning Android application package (APK) files for URLs, endpoints, and secrets. The application is used by FirmwareDroid, a backend solution for Android firmware analysis.

In a security advisory published on GitHub on January 21, the software’s maintainers said the security flaw “allows remote authenticated attackers to execute arbitrary OS commands via [the] package name inside application manifest”.

Escalated CVSS

The vulnerability, described as an improper neutralization of argument delimiters, is tracked as CVE-2021-21386 and has been issued a CVSS severity score of 9.3, an escalation from an original CVSS score of 7.3.

Reported by developer ‘RyotaK’ on March 19, 2021, the critical security issue surrounds a failure to protect against attackers issuing arguments that can trigger “unintended” commands, executing code remotely, or reading or tampering with sensitive information.

Catch up with the latest open source software security news

The advisory also notes the potential for attackers to conduct “other unintended behavior through [a] malicious package name”.

No authentication was required to exploit the vulnerability.

A patch to resolve the flaw released with APKLeaks version 2.0.3 failed to fully remedy the issue. RyotaK told The Daily Swig that the 2.0.4 patch resolved the problem correctly in the developer branch of the software, followed by v2.0.6-dev in the master branch.

The Daily Swig has reached out to the project’s developers with additional queries and we will update if and when we hear back.

YOU MIGHT ALSO LIKE RCE bug chain patched in CentOS Web Panel