CVE-2022-21675
Published: 12 January 2022
Summary
CVE-2022-21675 is a critical-severity Path Traversal (CWE-22) vulnerability in Bytecode Viewer Project Bytecode Viewer. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 7.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Bytecode Viewer (BCV), a Java and Android reverse engineering suite, is affected by an arbitrary file write vulnerability via archive extraction (Zip Slip) in all versions prior to 2.11.0. The flaw stems from insufficient validation of archive entries containing directory traversal sequences such as ../../evil.exe, allowing specially crafted zip, jar, tar, war, cpio, apk, rar, or 7z files to write or overwrite arbitrary files on the filesystem. It is tracked as CWE-22 with a CVSS 3.1 score of 9.9.
An attacker with the ability to supply a malicious archive to an affected BCV instance can exploit the issue to place executable files or web shells on the victim system. Successful exploitation can lead to remote command execution either by direct invocation of the written binary or by waiting for the system or user to trigger it, with the impact extending to both local and networked contexts given the CVSS attack vector of network and scope change.
The official GitHub security advisory and release notes for BCV v2.11.0 state that all users should upgrade immediately, as the commits in the 2.11.0 tag contain the necessary path sanitization fixes. No other mitigations or workarounds are recommended. The associated EPSS scores have remained low and stable near 0.08–0.09 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-26888
Vulnerability details
Bytecode Viewer (BCV) is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (AKA "Zip Slip"). The vulnerability is exploited using a specially crafted archive that holds directory…
more
traversal filenames (e.g. ../../evil.exe). The Zip Slip vulnerability can affect numerous archive formats, including zip, jar, tar, war, cpio, apk, rar and 7z. The attacker can then overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine. The impact of a Zip Slip vulnerability would allow an attacker to create or overwrite existing files on the filesystem. In the context of a web application, a web shell could be placed within the application directory to achieve code execution. All users should upgrade to BCV v2.11.0 when possible to receive a patch. There are no recommended workarounds aside from upgrading.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.