The developers of APKLeaks have fixed a serious vulnerability that could have been exploited by attackers to remotely execute arbitrary code.
APKLeaks is an open-source project created by Indonesian security engineer Dwi Siswanto. The program is designed to analyze Android packages (APKs) for URLs, endpoints, and secrets. The solution is also used in FirmwareDroid, a platform for analyzing Android firmware.
According to a security advisory published on GitHub on January 21, the vulnerability allowed a remote attacker to execute arbitrary OS commands via the package name in the application manifest.
“An attacker could add arguments that allowed them to run unintended commands, read or modify sensitive data, and cause other undesirable effects through a malicious package name,” the statement said.
The vulnerability was assigned the identifier CVE-2021-21386 and a maximum severity rating of 9.3 on the CVSS scale (previously, the vulnerability was assigned a rating of 7.3). The problem is described as incorrect neutralization of argument separators. It was discovered by a developer under the nickname RyotaK on March 19, 2021. The bug was that the application did not protect the system from passing parameters that could cause unwanted instructions to be executed, remote execution of malicious code, or access to sensitive data.
Exploiting the vulnerability did not require authentication. The first attempt to fix it was implemented in APKLeaks version 2.0.3, but it was incomplete. RyotaK later reported that the bug had been finally fixed in release 2.0.4 (development branch) and v2.0.6-dev (main branch).
The project developers have not yet provided additional comments on the incident, and a response from them is still pending.