Executive brief
apk-parser2 is a JavaScript library for parsing Android APK files. The package insecurely downloads executable resources over unencrypted HTTP, allowing attackers in privileged network positions to intercept and replace the executable with malware, leading to code execution on affected systems. No patch has been released since 2014.
Technical details
apk-parser2 downloads executable resources over unencrypted HTTP connections, creating a man-in-the-middle (MITM) vulnerability (CWE-311: Missing Encryption of Sensitive Data). An attacker with a privileged network position (e.g., on a public Wi-Fi network, compromised network router, or ISP-level access) can intercept the HTTP response and replace the executable with malicious code. This results in arbitrary code execution with the privileges of the user running apk-parser2. The vulnerability affects all versions up to and including 0.1.1, no patch is available, and the maintainer has not updated the package since 2014.
Affected products
- <UNKNOWN> apk-parser2 0.1.1 and earlier
Timeline
- 2018-09-18: disclosed: Advisory published to GitHub Advisory Database
- 2014: other: Package last updated; no patches released since