Executive brief
aaptjs is a Node.js wrapper for the Android Asset Packaging Tool (aapt), used by developers to process Android app resources. The vulnerability allows attackers to execute arbitrary code on a developer's machine by crafting malicious file path parameters, leading to complete system compromise including data theft, malware installation, and lateral movement to other systems.
Technical details
The vulnerability exists in the crunch function of aaptjs version 1.3.1 and earlier, where user-supplied filePath parameters are passed unsafely to a shell exec() call without proper sanitization or escaping (CWE-77, CWE-78). An attacker can inject shell metacharacters or arbitrary commands via the filePath parameter to break out of the intended command context. The attack requires no authentication and is exploitable over the network if the application using aaptjs accepts user input for file paths. A successful exploit results in remote code execution with the privileges of the process running aaptjs, allowing an attacker to achieve complete system compromise.
Affected products
- shenzhim aaptjs 1.3.1 and earlier
Timeline
- 2020-10-02: disclosed: Issue reported on GitHub
- 2021-11-01: advisory: GHSA published