CVE-2021-21381 – Flatpak's file forwarding feature contains a vu... (How to Fix)

Q: What is the severity of CVE-2021-21381?

CVE-2021-21381 has a CVSS score of 7.1 (HIGH). Flatpak's file forwarding feature contains a vulnerability where malicious app publishers can embed special tokens (@@ or @@u) in .desktop files to trick Flatpak into granting unauthorized file access. This allows attackers to bypass sandbox restrictions and access files outside the app's permitted scope. All Linux users running Flatpak versions 0.9.4 through 1.10.1 are affected.

📋 TL;DR

Flatpak's file forwarding feature contains a vulnerability where malicious app publishers can embed special tokens (@@ or @@u) in .desktop files to trick Flatpak into granting unauthorized file access. This allows attackers to bypass sandbox restrictions and access files outside the app's permitted scope. All Linux users running Flatpak versions 0.9.4 through 1.10.1 are affected.

💻 Affected Systems

Products:

Flatpak

Versions: 0.9.4 through 1.10.1

Operating Systems: Linux distributions using Flatpak

Default Config Vulnerable: ⚠️ Yes

Notes: All Flatpak installations within the affected version range are vulnerable by default when using the file forwarding feature.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Malicious Flatpak app gains unauthorized access to sensitive user files (documents, credentials, configuration files) that should be protected by sandbox permissions, potentially leading to data theft or further system compromise.

🟠

Likely Case

Malicious app publisher distributes a compromised Flatpak app that can access user files beyond its declared permissions, violating the sandbox security model.

🟢

If Mitigated

With proper controls, only trusted Flatpak apps are installed, limiting exposure to verified publishers and reducing attack surface.

🌐 Internet-Facing: MEDIUM - Attack requires user to install a malicious Flatpak app from untrusted sources, but distribution channels could be compromised.

🏢 Internal Only: LOW - Requires installation of malicious Flatpak packages, which is less likely in controlled environments with approved software sources.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user to install a malicious Flatpak app. The vulnerability is well-documented with public proof-of-concept in commit references and requires minimal technical skill to weaponize.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.10.2

Vendor Advisory: https://github.com/flatpak/flatpak/releases/tag/1.10.2

Restart Required: No

Instructions:

1. Update Flatpak using your distribution's package manager. 2. For Ubuntu/Debian: sudo apt update && sudo apt upgrade flatpak. 3. For Fedora/RHEL: sudo dnf update flatpak. 4. For Arch: sudo pacman -Syu flatpak. 5. Verify update with: flatpak --version

🔧 Temporary Workarounds

Manual .desktop file inspection

linux

Check exported .desktop files for malicious @@ or @@u tokens followed by literal filenames

grep -r '@@[^ ]*[[:space:]]' ~/.local/share/flatpak/exports/share/applications/ /var/lib/flatpak/exports/share/applications/ 2>/dev/null

Restrict Flatpak sources

linux

Only install Flatpak apps from trusted repositories and verified publishers

🧯 If You Can't Patch

Disable or uninstall Flatpak if not required
Implement strict application allowlisting for Flatpak installations

🔍 How to Verify

Check if Vulnerable:

Check Flatpak version: flatpak --version. If version is between 0.9.4 and 1.10.1 inclusive, system is vulnerable.

Check Version:

flatpak --version

Verify Fix Applied:

Confirm Flatpak version is 1.10.2 or higher: flatpak --version | grep -q '1\.10\.2\|1\.1[1-9]\|1\.[2-9]' && echo 'Patched'

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns from Flatpak applications
.desktop file modifications in Flatpak export directories

Network Indicators:

Downloads of Flatpak apps from untrusted sources

SIEM Query:

Process execution where parent_process contains 'flatpak' AND file_access includes sensitive paths outside expected sandbox

📊 Metadata

CVE ID: CVE-2021-21381

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

CWE: CWE-74

Published: March 11, 2021

Last Updated: November 21, 2024

🔗 References

https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb6a5d961 Patch,Third Party Advisory
https://github.com/flatpak/flatpak/commit/a7401e638bf0c03102039e216ab1081922f140ae Patch,Third Party Advisory
https://github.com/flatpak/flatpak/commit/eb7946bb6248923d8c90fe9b84425fef97ae580d Patch,Third Party Advisory
https://github.com/flatpak/flatpak/pull/4156 Patch,Third Party Advisory
https://github.com/flatpak/flatpak/releases/tag/1.10.2 Release Notes,Third Party Advisory
https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MXXLXC2DPJ45HSMTI5MZYHMYEGQN6AA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXNVFOIB6ZP4DGOVKAM25T6OIEP3YLGV/
https://security.gentoo.org/glsa/202312-12
https://www.debian.org/security/2021/dsa-4868 Third Party Advisory
https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb6a5d961 Patch,Third Party Advisory
https://github.com/flatpak/flatpak/commit/a7401e638bf0c03102039e216ab1081922f140ae Patch,Third Party Advisory
https://github.com/flatpak/flatpak/commit/eb7946bb6248923d8c90fe9b84425fef97ae580d Patch,Third Party Advisory
https://github.com/flatpak/flatpak/pull/4156 Patch,Third Party Advisory
https://github.com/flatpak/flatpak/releases/tag/1.10.2 Release Notes,Third Party Advisory
https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpp Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MXXLXC2DPJ45HSMTI5MZYHMYEGQN6AA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXNVFOIB6ZP4DGOVKAM25T6OIEP3YLGV/
https://security.gentoo.org/glsa/202312-12
https://www.debian.org/security/2021/dsa-4868 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-21381, you might also want to check these: