CVE-2020-36378
📋 TL;DR
CVE-2020-36378 is a command injection vulnerability in aaptjs packageCmd function that allows attackers to execute arbitrary code by controlling filePath parameters. This affects systems using shenzhim aaptjs version 1.3.1 for Android asset packaging. Attackers can achieve remote code execution with high privileges.
💻 Affected Systems
- shenzhim aaptjs
📦 What is this software?
Aaptjs by Aaptjs Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining root/administrator privileges, installing backdoors, stealing sensitive data, and pivoting to other systems.
Likely Case
Remote code execution leading to data theft, cryptocurrency mining, or ransomware deployment on vulnerable servers.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only affecting isolated container environments.
🎯 Exploit Status
Simple command injection via filePath parameter. GitHub issue shows exploitation details. No authentication required if vulnerable endpoint is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2 or later
Vendor Advisory: https://github.com/shenzhim/aaptjs/issues/2
Restart Required: No
Instructions:
1. Update aaptjs to version 1.3.2 or later using npm: npm update aaptjs 2. Verify installation with: npm list aaptjs 3. Test functionality with safe filePath inputs.
🔧 Temporary Workarounds
Input Validation Wrapper
allImplement strict input validation for filePath parameters before passing to aaptjs
// JavaScript example: const safePath = filePath.replace(/[;&|$`\n]/g, '')
Sandbox Execution
linuxRun aaptjs in isolated container or sandbox with limited permissions
docker run --read-only --cap-drop=ALL -v /safe/path:/data node aaptjs
🧯 If You Can't Patch
- Remove or disable aaptjs functionality from internet-facing systems
- Implement network segmentation to isolate systems using vulnerable aaptjs versions
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list aaptjs | grep 1.3.1Check Version:
npm list aaptjsVerify Fix Applied:
Run: npm list aaptjs | grep -v 1.3.1 && echo 'Not vulnerable'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution patterns from aaptjs processes
- File path parameters containing shell metacharacters (;, &, |, $, `)
Network Indicators:
- Unexpected outbound connections from build servers
- Traffic to known malicious IPs from systems running aaptjs
SIEM Query:
process.name:aaptjs AND cmdline:*[;&|$`]*