Executive brief
aaptjs is a Node.js wrapper around the Android Asset Packaging Tool (aapt). The packageCmd function fails to properly validate or sanitize file path parameters, allowing attackers to inject arbitrary shell commands and achieve remote code execution on systems using this library. An attacker can execute malicious code with the privileges of the application using aaptjs.
Technical details
aaptjs versions up to and including 1.3.1 are vulnerable to command injection in the packageCmd function due to unsafe command string construction. The vulnerable code uses exec() to run shell commands and directly concatenates unsanitized filePath parameters into the command string without proper quoting or validation. An attacker who can supply or control file path parameters (e.g., through API calls, file uploads, or configuration input) can embed shell metacharacters to break out of the intended command context and execute arbitrary commands. This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No fix or patch has been publicly released as of the advisory date; users should avoid using this library or implement strict input validation on file paths passed to aaptjs functions.
Affected products
- shenzhim aaptjs 0 through 1.3.1
Timeline
- 2020-10-02: disclosed: Issue reported on GitHub
- 2021-10-31: advisory: NVD published CVE-2020-36378
- 2021-11-02: advisory: GHSA-4qwq-q4pr-rr7r published