Executive brief
apk-parser is a tool used to extract Android app metadata from APK files. Versions before 0.1.6 download required resources over unencrypted HTTP connections, allowing attackers on a network to intercept and replace those resources with malicious code. This could lead to unauthorized code execution on a developer's machine during the APK analysis process.
Technical details
apk-parser is vulnerable to man-in-the-middle (MITM) attacks due to insecure HTTP-based download of binary resources (CWE-311: Missing Encryption of Sensitive Data). The vulnerability affects all versions before 0.1.6. An attacker positioned on the network path between the user and the remote resource server can intercept HTTP traffic and serve a malicious binary in place of the legitimate resource, potentially leading to remote code execution. The attack requires network-level access (adjacent network or compromised routing) but no authentication or user interaction beyond normal tool usage. The vulnerability was fixed in version 0.1.6 by switching to secure HTTPS connections.
Affected products
- apk-parser apk-parser <0.1.6
Timeline
- 2020-09-01: disclosed