CVE-2016-10632: Insecure Download of Executable in apk-parser2
Summary
CVE-2016-10632: apk-parser2 downloads Resources over HTTP. Affects apk-parser2 versions < 0.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
apk-parser2 is an npm package used for parsing APK files. It provides functionality to extract information from APK files, such as package name, version code, and permissions. However, versions of apk-parser2 prior to 0.1.1 are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The vulnerability in apk-parser2 arises from the insecure download of an executable file. When the package is installed on a system connected to a network, an attacker with a privileged network position can intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running apk-parser2. The risk of exploitation is higher when connected to a public network, but even on a private network, attackers who have compromised the network or have privileged access to the ISP can exploit this vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Unfortunately, no patch is currently available for this vulnerability, and the package has not been updated since 2014. The best mitigation is to avoid using apk-parser2 and opt for an alternative package if available. If you must use apk-parser2, it is recommended to ensure that the package is not installed while connected to a public network. This reduces the risk of interception and replacement of the executable by an attacker.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As there is no patch available, the only workaround is to avoid using apk-parser2 or to take precautions while using it. If you still choose to use apk-parser2, make sure to install it only on a private network and be cautious of any suspicious activity or unexpected behavior.
Conclusion
The vulnerability in apk-parser2 allows for the insecure download of an executable, which can be intercepted and replaced by an attacker. No patch is currently available, and the package has not been updated since 2014. It is recommended to avoid using apk-parser2 and opt for a different package if possible. If you still choose to use apk-parser2, take precautions and avoid installing it while connected to a public network. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apk-parser2 →
FAQ
apk-parser2 is an npm package used for parsing APK files. It provides functionality to extract information from APK files, such as package name, version code, and permissions.
The impact of this vulnerability is that an attacker with a privileged network position can intercept the response and replace the executable with a malicious one, leading to code execution on the system running apk-parser2.
No, there is currently no patch available for this vulnerability, and the package has not been updated since 2014.
The best mitigation is to avoid using apk-parser2 and choose an alternative package if possible. If you must use apk-parser2, ensure that it is not installed while connected to a public network.
In scenarios where the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised the network or those who have privileged access to the ISP, such as Nation State Actors or Rogue ISP Employees.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.