CVE-2024-21633: Apktool Path Traversal Vulnerability

CVE-2024-21633 Overview

CVE-2024-21633 is a path traversal vulnerability affecting Apktool, a widely-used tool for reverse engineering Android APK files. The vulnerability exists in versions 2.9.1 and prior, where Apktool improperly infers resource files' output paths based on their resource names. An attacker can manipulate these resource names to place files at arbitrary locations on the system where Apktool is executed.

Critical Impact

Attackers can write or overwrite any file accessible to the user running Apktool, potentially leading to code execution, credential theft, or system compromise when the username is known or the current working directory is under the user folder.

Affected Products

• Apktool versions 2.9.1 and prior
• All platforms where Apktool is deployed for APK reverse engineering

Discovery Timeline

• 2024-01-03 - CVE-2024-21633 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21633

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), which allows attackers to escape intended directory restrictions and access or modify files in arbitrary locations. The flaw exists in how Apktool processes resource names within APK files during the decompilation process.

Apktool trusts resource names embedded within APK files without proper sanitization. When processing a maliciously crafted APK, the tool uses these untrusted resource names to construct output file paths. By including path traversal sequences (such as ../) in resource names, an attacker can direct Apktool to write files outside the intended output directory.

The attack requires local access and user interaction—specifically, the victim must process a malicious APK file using Apktool. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability on the affected system.

Root Cause

The root cause is insufficient input validation and path sanitization when handling resource names from APK files. Apktool directly uses resource names to determine output file paths without verifying that the resulting path remains within the intended output directory boundaries. This allows specially crafted resource names containing directory traversal sequences to escape the sandbox.

Attack Vector

The attack requires an attacker to craft a malicious APK file with resource names containing path traversal sequences. When a security researcher, developer, or automated system processes this APK using Apktool, files can be written to arbitrary locations. Affected environments are those where:

1. The user's username is known to the attacker, allowing targeted file placement in user directories
2. The current working directory is within the user's home folder
3. The user has write access to sensitive system or application directories

Exploitation scenarios include overwriting shell configuration files (.bashrc, .profile), SSH authorized keys, or application configuration files to achieve persistent access or code execution.

Detection Methods for CVE-2024-21633

Indicators of Compromise

• Unexpected file modifications in user home directories after APK processing
• Files appearing outside the intended Apktool output directory
• APK files containing resource names with path traversal sequences (../, ..\)
• Modified configuration files (.bashrc, .profile, .ssh/authorized_keys) with suspicious timestamps

Detection Strategies

• Monitor file system activity during Apktool execution for writes outside expected directories
• Implement file integrity monitoring (FIM) on sensitive directories and configuration files
• Scan incoming APK files for resource names containing path traversal patterns before processing
• Review Apktool command execution logs for processing of untrusted APK sources

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions to monitor process behavior and file operations
• Configure alerts for file writes in sensitive directories when spawned from Java processes running Apktool
• Establish baselines for Apktool output patterns and alert on deviations
• Monitor for newly created or modified files in user profile directories that correlate with APK processing activities

How to Mitigate CVE-2024-21633

Immediate Actions Required

• Update Apktool to a version containing the security fix (commit d348c43b24a9de350ff6e5bd610545a10c1fc712 or later)
• Audit systems where Apktool is deployed for signs of exploitation
• Process untrusted APK files only in isolated environments such as containers or virtual machines
• Review and restore any files that may have been modified by malicious APK processing

Patch Information

The Apktool development team has addressed this vulnerability in commit d348c43b24a9de350ff6e5bd610545a10c1fc712. Users should update to a version that includes this commit. Detailed information about the vulnerability and fix is available in the GitHub Security Advisory GHSA-2hqv-2xv4-5h5w.

Workarounds

• Run Apktool in a sandboxed environment (Docker container, VM, or restricted user account) when processing untrusted APKs
• Implement strict output directory restrictions using operating system-level access controls
• Use a dedicated, unprivileged user account for APK analysis that has no write access to sensitive system files
• Validate APK resource names for path traversal sequences before processing with unpatched Apktool versions

# Example: Run Apktool in an isolated Docker container
docker run --rm -v $(pwd)/input:/input:ro -v $(pwd)/output:/output apktool-container apktool d /input/suspicious.apk -o /output/decompiled

# Example: Create restricted user for APK analysis
sudo useradd -r -s /bin/false -M apktool-user
sudo -u apktool-user apktool d suspicious.apk -o /tmp/apk-output