Vulnerability-Lookup

GHSA-8434-V7XW-8M9X

Vulnerability from github – Published: 2022-01-21 23:03 – Updated: 2022-05-27 22:48

Summary

Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks

Details

APKLeaks prior to v2.0.4 allows remote authenticated attackers to execute arbitrary OS commands via package name inside the application manifest.

Impact

An authenticated attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified, or could cause other unintended behavior through malicious package names.

References

a966e781499ff6fd4eea66876d7532301b13a382

For more information

If you have any questions or comments about this advisory: * Email me at me@dw1.io

Severity

9.3 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "APKLeaks"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-21T21:03:01Z",
    "nvd_published_at": "2021-03-24T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "APKLeaks prior to v2.0.4 allows remote authenticated attackers to execute arbitrary OS commands via package name inside the application manifest.\n\n### Impact\n\nAn authenticated attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified, or could cause other unintended behavior through malicious package names.\n\n\n### References\n\n- a966e781499ff6fd4eea66876d7532301b13a382\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Email me at [me@dw1.io](mailto:me@dw1.io)\n",
  "id": "GHSA-8434-v7xw-8m9x",
  "modified": "2022-05-27T22:48:38Z",
  "published": "2022-01-21T23:03:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21386"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dwisiswant0/apkleaks"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks"
}

CVE-2021-21386 (GCVE-0-2021-21386)

Vulnerability from cvelistv5 – Published: 2021-03-24 20:55 – Updated: 2024-08-03 18:09

Title

Improper Neutralization of Argument Delimiters in a Decompiling Package Process

Summary

APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-78 - OS Command Injection

Assigner

GitHub_M

References

2 references

URL	Tags
https://github.com/dwisiswant0/apkleaks/security/…	x_refsource_CONFIRM
https://github.com/dwisiswant0/apkleaks/commit/a9…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dwisiswant0	apkleaks	Affected: < 2.0.6-dev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:16.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "apkleaks",
          "vendor": "dwisiswant0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.6-dev"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "APKLeaks is an open-source project for scanning APK file for URIs, endpoints \u0026 secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-24T20:55:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382"
        }
      ],
      "source": {
        "advisory": "GHSA-8434-v7xw-8m9x",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Neutralization of Argument Delimiters in a Decompiling Package Process",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21386",
          "STATE": "PUBLIC",
          "TITLE": "Improper Neutralization of Argument Delimiters in a Decompiling Package Process"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "apkleaks",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 2.0.6-dev"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "dwisiswant0"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "APKLeaks is an open-source project for scanning APK file for URIs, endpoints \u0026 secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior through malicious package name. The problem is fixed in version v2.0.6-dev and above."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78 OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x",
              "refsource": "CONFIRM",
              "url": "https://github.com/dwisiswant0/apkleaks/security/advisories/GHSA-8434-v7xw-8m9x"
            },
            {
              "name": "https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382",
              "refsource": "MISC",
              "url": "https://github.com/dwisiswant0/apkleaks/commit/a966e781499ff6fd4eea66876d7532301b13a382"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-8434-v7xw-8m9x",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21386",
    "datePublished": "2021-03-24T20:55:14.000Z",
    "dateReserved": "2020-12-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:09:16.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-8434-V7XW-8M9X

Impact

References

For more information

CVE-2021-21386 (GCVE-0-2021-21386)

Tags

Sightings

Nomenclature