Executive brief
aaptjs is a Node.js wrapper for the Android Asset Packaging Tool (aapt). The dump function fails to properly sanitize file path parameters, allowing attackers to inject and execute arbitrary shell commands. An attacker can exploit this to gain full system access, steal sensitive data, or disrupt service availability.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-78) in the dump function of aaptjs that passes unsanitized user input directly to shell execution via the exec() call. The filePath parameter is not validated or escaped before being used in command construction, allowing an attacker to break out of the intended command and execute arbitrary shell code. The attack requires network access to an application using aaptjs, with no authentication or user interaction needed. An attacker can achieve remote code execution with the privileges of the Node.js process. The vulnerability affects aaptjs versions 1.3.1 and earlier; patch status is unclear from available sources.
Affected products
- shenzhim aaptjs 1.3.1 and earlier
Timeline
- 2020-10-02: disclosed: Issue raised on GitHub
- 2021-11-02: advisory: GHSA advisory published
- 2021-10-31: other: CVE-2020-36377 published on NVD