CVE-2024-32653 MEDIUM

CVE-2024-32653: Insufficient input filtering of "package name" allows command execution in the device with shell privileges

Vendor Skylot
Product jadx
Weakness CWE-20 · Input validation
Published April 22, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

What the vulnerability does

01Description

jadx is a Dex to Java decompiler. Prior to version 1.5.0, the package name is not filtered before concatenation. This can be exploited to inject arbitrary code into the package name. The vulnerability allows an attacker to execute commands with shell privileges. Version 1.5.0 contains a patch for the vulnerability.

Key dates

02Disclosure timeline

April 22, 2024 CVE published
August 2, 2024 Record updated