The maintainers of APKLeaks have patched a critical vulnerability that could lead to remote execution of arbitrary code.
Created by Indonesia-based security engineer Dwi Siswanto, APKLeaks is open source software for scanning Android application package (APK) files for URLs, endpoints, and secrets. The application is used by FirmwareDroid, a backend solution for Android firmware analysis.
In a security advisory published on GitHub on January 21, the software’s maintainers said the security flaw “allows remote authenticated attackers to execute arbitrary OS commands via [the] package name inside application manifest”.
Escalated CVSS
The vulnerability, described as an improper neutralization of argument delimiters, is tracked as CVE-2021-21386 and has been issued a CVSS severity score of 9.3, an escalation from an original CVSS score of 7.3.
Reported by developer ‘RyotaK’ on March 19, 2021, the critical security issue surrounds a failure to protect against attackers issuing arguments that can trigger “unintended” commands, executing code remotely, or reading or tampering with sensitive information.
The advisory also notes the potential for attackers to conduct “other unintended behavior through [a] malicious package name”.
No authentication was required to exploit the vulnerability.
A patch to resolve the flaw released with APKLeaks version 2.0.3 failed to fully remedy the issue. RyotaK told The Daily Swig that the 2.0.4 patch resolved the problem correctly in the developer branch of the software, followed by v2.0.6-dev in the master branch.
You may also enjoy reading, Assange Wins First Stage in Effort to Appeal US Extradition
Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today
Remember, CyberSecurity Starts With You!
- Globally, 30,000 websites are hacked daily.
- 64% of companies worldwide have experienced at least one form of a cyber attack.
- There were 20M breached records in March 2021.
- In 2020, ransomware cases grew by 150%.
- Email is responsible for around 94% of all malware.
- Every 39 seconds, there is a new attack somewhere on the web.
- An average of around 24,000 malicious mobile apps are blocked daily on the internet.
