Is CVE-2020-36378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-36378 being exploited in the wild.

How severe is CVE-2020-36378?

Low severity, with a CVSS score of 3.1, published 2 November 2021.

Which products and versions are affected?

aaptjs (npm) SEMVER:introduced=0,last_affected=1.3.1.

Is there a fix for CVE-2020-36378?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2020-36378 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-36378?

Check whether you run aaptjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-36378: aaptjs packageCmd arbitrary code execution via filePath

CVE-2020-36378 · Severity: low · CVSS 3.1 · Published 2021-11-02

aaptjs is a Node.js wrapper around the Android Asset Packaging Tool (aapt). The packageCmd function fails to properly validate or sanitize file path parameters, allowing attackers to inject arbitrary shell commands and achieve remote code execution on systems using this library. An attacker can execute malicious code with the privileges of the application using aaptjs.

Technologies: aaptjs (npm). Vendors: npm.

Quick answers

Is CVE-2020-36378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-36378 being exploited in the wild.
How severe is CVE-2020-36378?: Low severity, with a CVSS score of 3.1, published 2 November 2021.
Which products and versions are affected?: aaptjs (npm) SEMVER:introduced=0,last_affected=1.3.1.
Is there a fix for CVE-2020-36378?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2020-36378 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-36378?: Check whether you run aaptjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

aaptjs versions up to and including 1.3.1 are vulnerable to command injection in the packageCmd function due to unsafe command string construction. The vulnerable code uses exec() to run shell commands and directly concatenates unsanitized filePath parameters into the command string without proper quoting or validation. An attacker who can supply or control file path parameters (e.g., through API calls, file uploads, or configuration input) can embed shell metacharacters to break out of the intended command context and execute arbitrary commands. This vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command) and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No fix or patch has been publicly released as of the advisory date; users should avoid using this library or implement strict input validation on file paths passed to aaptjs functions.

Affected products

shenzhim aaptjs 0 through 1.3.1

Identifiers

CVE-2020-36378
GHSA-4qwq-q4pr-rr7r

Timeline

2020-10-02: disclosed: Issue reported on GitHub
2021-10-31: advisory: NVD published CVE-2020-36378
2021-11-02: advisory: GHSA-4qwq-q4pr-rr7r published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.