Apktool
CVE-2024-21633
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionGitHub Advisory
Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.
AnalysisAI
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK resources with crafted filenames can write files to arbitrary locations on the system, enabling code execution on developer and CI/CD machines that analyze untrusted APKs.
Technical ContextAI
Apktool processes Android APK files by extracting and decompiling resources. Resource filenames from the APK's resource table are used to create output paths without proper sanitization. A malicious APK can include resources with path traversal sequences (e.g., ../../.bashrc) that write files outside the intended output directory when decompiled.
RemediationAI
Update to Apktool 2.9.2 or later. Run APK analysis in sandboxed environments (containers, VMs). Never decompile untrusted APKs on production machines. Review output directories after Apktool runs for files outside the expected project structure.
Share
External POC / Exploit Code
Leaving vuln.today