CVE-2024-21633

Deeper analysis

Apktool is a command-line tool used for reverse engineering Android APK files. CVE-2024-21633 is a path traversal vulnerability (CWE-22) present in versions 2.9.1 and earlier. The tool determines output paths for resource files solely from names embedded in the APK, allowing an attacker-controlled name to influence filesystem writes performed during decoding or rebuilding operations.

An attacker can supply a malicious APK that, when processed by Apktool under a user account, causes arbitrary files to be written or overwritten in locations where that user has write access. Successful exploitation requires either knowledge of the target username or execution from a working directory beneath the user’s home folder, and can result in modification of configuration, binaries, or other sensitive files on the host system. The CVSS 7.8 score reflects local attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

The project’s security advisory GHSA-2hqv-2xv4-5h5w and the referenced commit d348c43b24a9de350ff6e5bd610545a10c1fc712 document the fix and recommend that users update to a patched release. The EPSS score rose from lower values to a peak of 0.8052 before receding to the current 0.6819, indicating increased exploitation interest after disclosure.