Executive brief
aaptjs is a Node.js wrapper for the Android Asset Packaging Tool (aapt). A vulnerability in the singleCrunch function allows attackers to execute arbitrary code by crafting malicious filePath parameters. An application using this library to process untrusted Android package files could be compromised, allowing attackers to take full control of the system running the vulnerable code.
Technical details
The vulnerability is a command injection flaw (CWE-78) in the singleCrunch function where user-supplied filePath parameters are not properly sanitized before being passed to an exec() call. The vulnerable code directly concatenates user input into shell commands without escaping or validation. An unauthenticated attacker can exploit this by providing specially crafted filePath values that include shell metacharacters, allowing arbitrary command execution with the privileges of the Node.js process. The vulnerability affects aaptjs version 1.3.1 and all prior versions. As of the advisory publication (November 2021), no patch was explicitly indicated, requiring users to avoid this library or upgrade if a fixed version becomes available.
Affected products
- shenzhim aaptjs 1.3.1 and earlier
Timeline
- 2021-11-01: disclosed: GHSA advisory published
- 2020-10-02: other: Issue reported on GitHub