CVE-2024-24482
📋 TL;DR
CVE-2024-24482 is a path traversal vulnerability in Apktool on Windows that allows attackers to write files outside intended directories using '../' sequences. This affects Windows users running Apktool versions before 2.9.3 for Android APK analysis and modification.
💻 Affected Systems
- Apktool
📦 What is this software?
Apktool by Apktool
⚠️ Risk & Real-World Impact
Worst Case
Arbitrary file write leading to system compromise, malware installation, or data destruction through overwriting critical system files.
Likely Case
Local privilege escalation, arbitrary file creation/modification in user-writable directories, or persistence mechanisms.
If Mitigated
Limited to user context file operations if proper file permissions and sandboxing are enforced.
🎯 Exploit Status
Exploitation requires user to process a malicious APK file. Path traversal payloads in APK resources can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.3
Vendor Advisory: https://github.com/iBotPeaches/Apktool/security/advisories/GHSA-vgwr-4w3p-xmjv
Restart Required: No
Instructions:
1. Download Apktool 2.9.3 or later from official GitHub releases. 2. Replace existing apktool.jar with new version. 3. Verify installation with 'java -jar apktool.jar --version'.
🔧 Temporary Workarounds
Use Linux/macOS
allRun Apktool on non-Windows platforms where the vulnerability does not exist
Restrict APK Sources
allOnly process APK files from trusted sources
🧯 If You Can't Patch
- Run Apktool in a sandboxed/isolated environment with limited file system access
- Implement strict file permission controls to limit write access to non-critical directories
🔍 How to Verify
Check if Vulnerable:
Check Apktool version with 'java -jar apktool.jar --version'. If version is below 2.9.3 and running on Windows, system is vulnerable.Check Version:
java -jar apktool.jar --versionVerify Fix Applied:
After updating, run 'java -jar apktool.jar --version' to confirm version 2.9.3 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Apktool processing errors with path traversal patterns
Network Indicators:
- Downloads of APK files from untrusted sources followed by Apktool execution
SIEM Query:
Process execution: 'java' with command line containing 'apktool' AND File creation/modification with paths containing '../' sequences