CVE-2020-36376: Vulnerability in aaptjs leads to arbitrary code execution via filePath parameters
Summary
CVE-2020-36376: Vulnerability in list function leads to arbitrary code execution via filePath parameters. Affects aaptjs versions < 1.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
aaptjs is a node wrapper for aapt, a tool used for Android application packaging. It provides a convenient way to interact with aapt functionality in Node.js applications. The vulnerability affects version 1.3.1 of the aaptjs package. This vulnerability allows attackers to execute arbitrary code by exploiting the list function in shenzhim aaptjs. The list function takes filePath parameters, which can be manipulated to execute malicious code.
Vulnerability Detail
The vulnerability in aaptjs version 1.3.1 arises from a lack of proper input validation in the list function. Attackers can provide specially crafted filePath parameters that contain malicious code. When the list function processes these parameters, it fails to properly sanitize the input, leading to arbitrary code execution. This can have severe consequences, as attackers can execute any code of their choice on the affected system, potentially compromising its security and integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the list function in the affected version of aaptjs. By refraining from using this specific functionality, the risk of exploitation can be mitigated. However, this is not a permanent solution, and it is strongly recommended to update to a patched version of aaptjs as soon as possible.
Conclusion
The vulnerability in aaptjs version 1.3.1 allows attackers to execute arbitrary code by manipulating the filePath parameters in the list function. To mitigate this vulnerability, it is crucial to update to the latest version of aaptjs, which includes a fix for this issue. Avoiding the use of the list function in the affected version can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aaptjs →
FAQ
aaptjs is a node wrapper for aapt, a tool used for Android application packaging. It provides a convenient way to interact with aapt functionality in Node.js applications.
This vulnerability allows attackers to execute arbitrary code on the affected system. They can potentially gain unauthorized access, compromise data, and perform other malicious activities.
Version 1.3.1 of the aaptjs package is affected by this vulnerability.
Yes, the maintainers of aaptjs have released a fix in a subsequent version. It is recommended to update to the latest version of aaptjs to mitigate this vulnerability.
As a temporary workaround, users can avoid using the list function in the affected version of aaptjs. However, updating to a patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for aaptjs.
