{"answers":{"affected":"2 open source packages ship an affected version, including io.github.skylot:jadx-core.","exploited":"There is no known exploitation of GHSA-hvp5-5x4f-33fq in the wild and no public exploit code.","fix":"Upgrade io.github.skylot:jadx-core to 1.5.0 or later.","what":"GHSA-hvp5-5x4f-33fq is a path traversal vulnerability in io.github.skylot:jadx-core, published on 22 Apr 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-hvp5-5x4f-33fq and fix it if it is affected.\n\nWhat it is: GHSA-hvp5-5x4f-33fq is a path traversal vulnerability in io.github.skylot:jadx-core, published on 22 Apr 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-hvp5-5x4f-33fq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- io.github.skylot:jadx-core (Maven): affected all versions; fixed in 1.5.0\n- io.github.skylot:jadx-core (Maven): affected all versions; fixed in 1.5.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-hvp5-5x4f-33fq/ (Markdown: https://insights.sbomify.com/GHSA-hvp5-5x4f-33fq/index.md)","id":"GHSA-hvp5-5x4f-33fq","markdown":"https://insights.sbomify.com/GHSA-hvp5-5x4f-33fq/index.md","name":"GHSA-hvp5-5x4f-33fq","record":{"aliases":[],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["data_modify"],"network_reachable":"no","non_default_config":false,"product_category":"Android decompiler","requires_auth":"none","summary":"A malicious APK can overwrite files in the output directory during decompilation due to improper handling of style resource filenames.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nwhen jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result.\n\nAlthough I don't think this vulnerability realizes path traversal in the true sense of the word , I reported it anyway\n\n### Details\n\nI see that getResAlias does something with the filename.\n\n```java\nprivate String getResAlias(int resRef, String origKeyName, @Nullable FieldNode constField) {\n```\n\nbut type style will return the original filename directly.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212491.jpeg)\nso our goal is to take a malicious file that was originally of type raw, modify its type to style, trick jadx into\n\n#### step1\n\ncreate an android project using androidstudio and create a raw folder with the name attack_file_sayhiiiiiiiiiiiii, it doesn't matter what the content is!\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212073.jpg)\ngenerate an initial APK\n\n#### step2 \n\nextract this initial APK using ZIP software to get resources.arsc\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212841.jpg)\ndrop resources.arsc into 010editor\n\n#### step3\n\nsearch for the previous filename attack_file_sayhiiiiiiiiiiiii , two will appear here, we choose the second one\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213527.jpg)\nlet's change the name of the file here. I'll change it to ../../_file_sayhiiiiiiiiiiiii\n\nnote that you can only overwrite files in the folder where the decompile was saved.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213343.jpg)\n#### step4 \nchange the type of this file to style\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213183.jpg)\nmodified to 0E\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213484.jpg)\n#### step5 \n\nAfter saving, re-compress the whole folder into a zip, then change the extension to APK.\n\nopen it with JADX and you can see that it has been changed to a style type.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213864.jpg)\nclick save all\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213119.jpg)\nyou can see the file escaping.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213746.jpg)\nso we can also construct a  \n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213497.jpg)\nso the classes.dex file is also replaced here\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213075.jpg)\n\n### PoC\nthe details above have been written\n\n### Impact\nlatest version","ecosystems":["Maven"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"JADX file override vulnerability","id":"GHSA-hvp5-5x4f-33fq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Maven","product":null,"products":[],"type":"path_traversal","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Maven","fixed":["1.5.0"],"introduced":["0"],"last_affected":[],"package":"io.github.skylot:jadx-core","purl":null,"source":"GHSA-hvp5-5x4f-33fq"},{"ecosystem":"Maven","fixed":["1.5.0"],"introduced":["0"],"last_affected":[],"package":"io.github.skylot:jadx-core","purl":"pkg:maven/io.github.skylot/jadx-core","source":"GHSA-hvp5-5x4f-33fq"}],"products":null,"published":"2024-04-22","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A malicious APK can overwrite files in the output directory during decompilation due to improper handling of style resource filenames.","url":"https://insights.sbomify.com/GHSA-hvp5-5x4f-33fq/"}