Executive brief
aaptjs is a Node.js library used to parse Android application packages (APK files). The library fails to properly sanitize user input in its list function, allowing an attacker to inject arbitrary shell commands that execute with the privileges of the Node.js process. This could lead to complete system compromise, data theft, or denial of service.
Technical details
aaptjs contains a command injection vulnerability (CWE-77, CWE-78) in the list function. The vulnerability arises from insecure command formatting where user-supplied filePath parameters are passed directly to the shell execution function (exec) without proper validation or escaping. An attacker can pass a malicious filePath containing shell metacharacters to break out of the intended command and execute arbitrary code. The attack requires no authentication and is reachable over the network if the vulnerable aaptjs library is exposed via a web service. Successful exploitation grants the attacker command execution in the context of the Node.js process. All versions up to and including 1.3.1 are affected.
Affected products
- shenzhim aaptjs 1.3.1 and earlier
Timeline
- 2020-10-02: disclosed: Vulnerability reported on GitHub issue #2
- 2021-10-31: advisory: NVD publication
- 2021-11-02: advisory: GHSA advisory published