CVE-2024-21633
📋 TL;DR
CVE-2024-21633 is a path traversal vulnerability in Apktool that allows attackers to write files to arbitrary locations on the system where Apktool runs. This affects users who process untrusted APK files with Apktool versions 2.9.1 and earlier, particularly in environments where attackers can predict user directories or current working paths.
💻 Affected Systems
- Apktool
📦 What is this software?
Apktool by Apktool
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file write leading to remote code execution, privilege escalation, or data destruction.
Likely Case
Local file system manipulation, overwriting configuration files, planting backdoors, or corrupting user data.
If Mitigated
Limited to writing files only within controlled directories with proper permissions and input validation.
🎯 Exploit Status
Exploitation requires crafting malicious APK files with manipulated resource names. The advisory includes technical details that facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit d348c43b24a9de350ff6e5bd610545a10c1fc712
Vendor Advisory: https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5w
Restart Required: No
Instructions:
1. Update Apktool to version 2.9.2 or later. 2. Download from official GitHub releases. 3. Replace existing Apktool JAR file with patched version.
🔧 Temporary Workarounds
Run Apktool in isolated container
allExecute Apktool within Docker or similar container with restricted filesystem access
docker run --rm -v $(pwd):/apks -w /apks openjdk:11 java -jar apktool.jar d malicious.apk
Use dedicated low-privilege user
linuxRun Apktool under a non-privileged user account with minimal write permissions
sudo -u apktooluser java -jar apktool.jar d malicious.apk
🧯 If You Can't Patch
- Only process APK files from trusted sources with verified integrity
- Run Apktool in sandboxed environments with restricted filesystem access
🔍 How to Verify
Check if Vulnerable:
Check Apktool version: java -jar apktool.jar --version. If version is 2.9.1 or earlier, you are vulnerable.Check Version:
java -jar apktool.jar --versionVerify Fix Applied:
After updating, verify version is 2.9.2 or later. Test with known malicious APK samples in controlled environment.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Apktool process writing to system directories
Network Indicators:
- N/A - Local vulnerability
SIEM Query:
Process:apktool AND (FileCreate:*\..* OR FileCreate:*\..*\..*)🔗 References
- https://github.com/iBotPeaches/Apktool/commit/d348c43b24a9de350ff6e5bd610545a10c1fc712
- https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5w
- https://github.com/iBotPeaches/Apktool/commit/d348c43b24a9de350ff6e5bd610545a10c1fc712
- https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-2hqv-2xv4-5h5w
