APKLeaks Fixes Critical Vulnerability

The maintainers of APKLeaks have patched a critical vulnerability that could be exploited for the remote execution of arbitrary code.

APKLeaks is open-source software for scanning Android application package (APK) files for URLs, endpoints, and secrets. The application is used by FirmwareDroid, a backend solution for Android firmware analysis.

In an advisory published, the software’s maintainers said the security flaw allows remote authenticated attackers to execute arbitrary OS commands via package name inside application manifest.

The vulnerability, described as an improper neutralization of argument delimiters, is tracked as CVE-2021-21386 and has been issued a CVSS severity score of 9.3, an escalation from an original CVSS score of 7.3.

The critical security issue surrounds a failure to protect against attackers issuing arguments that can trigger unintended commands, executing code remotely, or reading or tampering with sensitive information

The advisory also notes the potential for attackers to conduct other unintended behaviour through malicious package name. No authentication was required to exploit the vulnerability.

A patch to resolve the flaw released with APKLeaks version 2.0.3 failed to fully remedy the issue. The 2.0.4 patch resolved the problem correctly in the developer branch of the software, followed by v2.0.6-dev in the master branch.