CVE-2016-10564: Vulnerability in apk-parser
Summary
CVE-2016-10564: Downloads Resources over HTTP in apk-parser. Affects apk-parser versions < 0.1.6. Fixed in 0.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
apk-parser is an npm package used to extract Android Manifest information from an APK file. It provides functionality to analyze and parse APK files, allowing developers to retrieve important details about the Android application. However, versions below 0.1.6 of apk-parser have a vulnerability that allows downloading binary resources over HTTP. This exposes the package to potential Man-in-the-Middle (MITM) attacks, where an attacker can intercept and modify the requested binary resources, potentially leading to remote code execution (RCE) if the user is connected to an unsecured network or if the attacker is positioned between the user and the remote server.
Vulnerability Detail
The vulnerability in apk-parser versions below 0.1.6 arises from the insecure downloading of binary resources over HTTP. This exposes the package to potential MITM attacks, where an attacker can intercept the requested binaries and replace them with malicious ones. If successful, this could result in the execution of arbitrary code on the user's device. The vulnerability has been assigned the identifier CVE-2016-10564.
How To Fix
Minimum fixed version
0.1.6
This is the first release that contains the fix.
npm install apk-parser@0.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in apk-parser versions below 0.1.6 exposes the package to potential MITM attacks, which can result in the execution of arbitrary code on the user's device. To mitigate this risk, it is crucial to update apk-parser to version 0.1.6 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apk-parser →
FAQ
apk-parser is an npm package used to extract Android Manifest information from APK files.
The vulnerability in apk-parser versions below 0.1.6 exposes the package to potential MITM attacks, which could lead to remote code execution on the user's device.
To fix this vulnerability, update apk-parser to version 0.1.6 or later.
No, the recommended solution is to update apk-parser to the latest version.
You can find more information about this vulnerability in the CVE-2016-10564 advisory.
