Executive brief
apk-parser3 is a Node.js library for parsing Android APK files. The library downloads an executable dependency over unencrypted HTTP, allowing an attacker with network access to intercept and replace it with malicious code, leading to arbitrary code execution on systems using this library.
Technical details
apk-parser3 contains an insecure download vulnerability (CWE-311: Missing Encryption of Sensitive Data) where it retrieves an executable dependency over an unencrypted HTTP connection rather than HTTPS. An attacker positioned on the network path between the library and the download server can intercept the HTTP response and serve malicious content instead. This attack requires the attacker to have a privileged network position (e.g., compromised router, ISP-level access, ARP spoofing on LAN) but no authentication or user interaction is required. A successful exploit grants the attacker code execution within the context of the application using apk-parser3. The vulnerability affects all versions prior to 0.1.3, which contains a fix to use HTTPS for downloads.
Affected products
- apk-parser3 apk-parser3 0 to <0.1.3
Timeline
- 2020-09-01: disclosed: Advisory published on GitHub/OSV
- 0.1.3: patched: Fixed version available