{"id":"GHSA-hvp5-5x4f-33fq","aliases":[],"status":"published","title":"JADX file override vulnerability","description":"### Summary\nwhen jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result.\n\nAlthough I don't think this vulnerability realizes path traversal in the true sense of the word , I reported it anyway\n\n### Details\n\nI see that getResAlias does something with the filename.\n\n```java\nprivate String getResAlias(int resRef, String origKeyName, @Nullable FieldNode constField) {\n```\n\nbut type style will return the original filename directly.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212491.jpeg)\nso our goal is to take a malicious file that was originally of type raw, modify its type to style, trick jadx into\n\n#### step1\n\ncreate an android project using androidstudio and create a raw folder with the name attack_file_sayhiiiiiiiiiiiii, it doesn't matter what the content is!\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212073.jpg)\ngenerate an initial APK\n\n#### step2 \n\nextract this initial APK using ZIP software to get resources.arsc\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212841.jpg)\ndrop resources.arsc into 010editor\n\n#### step3\n\nsearch for the previous filename attack_file_sayhiiiiiiiiiiiii , two will appear here, we choose the second one\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213527.jpg)\nlet's change the name of the file here. I'll change it to ../../_file_sayhiiiiiiiiiiiii\n\nnote that you can only overwrite files in the folder where the decompile was saved.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213343.jpg)\n#### step4 \nchange the type of this file to style\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213183.jpg)\nmodified to 0E\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213484.jpg)\n#### step5 \n\nAfter saving, re-compress the whole folder into a zip, then change the extension to APK.\n\nopen it with JADX and you can see that it has been changed to a style type.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213864.jpg)\nclick save all\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213119.jpg)\nyou can see the file escaping.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213746.jpg)\nso we can also construct a  \n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213497.jpg)\nso the classes.dex file is also replaced here\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213075.jpg)\n\n### PoC\nthe details above have been written\n\n### Impact\nlatest version","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2024-04-22T15:56:04Z","modified":"2024-12-05T05:30:54Z","fixes":[{"ecosystem":"Maven","package":"io.github.skylot:jadx-core","fixed_in":["1.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.github.skylot:jadx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.github.skylot:jadx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0"}]}],"versions":["1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7"]}],"references":[{"url":"https://github.com/skylot/jadx/security/advisories/GHSA-hvp5-5x4f-33fq","tags":["web"]},{"url":"https://github.com/skylot/jadx/commit/d86449a8ea26381d0ce6fafaed7deb7542dfd70b","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hvp5-5x4f-33fq"},{"url":"https://github.com/skylot/jadx","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-hvp5-5x4f-33fq","title":"JADX file override vulnerability","description":"### Summary\nwhen jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result.\n\nAlthough I don't think this vulnerability realizes path traversal in the true sense of the word , I reported it anyway\n\n### Details\n\nI see that getResAlias does something with the filename.\n\n```java\nprivate String getResAlias(int resRef, String origKeyName, @Nullable FieldNode constField) {\n```\n\nbut type style will return the original filename directly.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212491.jpeg)\nso our goal is to take a malicious file that was originally of type raw, modify its type to style, trick jadx into\n\n#### step1\n\ncreate an android project using androidstudio and create a raw folder with the name attack_file_sayhiiiiiiiiiiiii, it doesn't matter what the content is!\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212073.jpg)\ngenerate an initial APK\n\n#### step2 \n\nextract this initial APK using ZIP software to get resources.arsc\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212841.jpg)\ndrop resources.arsc into 010editor\n\n#### step3\n\nsearch for the previous filename attack_file_sayhiiiiiiiiiiiii , two will appear here, we choose the second one\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213527.jpg)\nlet's change the name of the file here. I'll change it to ../../_file_sayhiiiiiiiiiiiii\n\nnote that you can only overwrite files in the folder where the decompile was saved.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213343.jpg)\n#### step4 \nchange the type of this file to style\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213183.jpg)\nmodified to 0E\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213484.jpg)\n#### step5 \n\nAfter saving, re-compress the whole folder into a zip, then change the extension to APK.\n\nopen it with JADX and you can see that it has been changed to a style type.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213864.jpg)\nclick save all\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213119.jpg)\nyou can see the file escaping.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213746.jpg)\nso we can also construct a  \n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213497.jpg)\nso the classes.dex file is also replaced here\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213075.jpg)\n\n### PoC\nthe details above have been written\n\n### Impact\nlatest version \n","status":"published","published":"2024-04-22T15:56:04Z","modified":"2024-04-22T15:56:06Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:43.62603Z"}],"osv":[{"id":"GHSA-hvp5-5x4f-33fq","title":"JADX file override vulnerability","description":"### Summary\nwhen jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result.\n\nAlthough I don't think this vulnerability realizes path traversal in the true sense of the word , I reported it anyway\n\n### Details\n\nI see that getResAlias does something with the filename.\n\n```java\nprivate String getResAlias(int resRef, String origKeyName, @Nullable FieldNode constField) {\n```\n\nbut type style will return the original filename directly.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212491.jpeg)\nso our goal is to take a malicious file that was originally of type raw, modify its type to style, trick jadx into\n\n#### step1\n\ncreate an android project using androidstudio and create a raw folder with the name attack_file_sayhiiiiiiiiiiiii, it doesn't matter what the content is!\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212073.jpg)\ngenerate an initial APK\n\n#### step2 \n\nextract this initial APK using ZIP software to get resources.arsc\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212841.jpg)\ndrop resources.arsc into 010editor\n\n#### step3\n\nsearch for the previous filename attack_file_sayhiiiiiiiiiiiii , two will appear here, we choose the second one\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213527.jpg)\nlet's change the name of the file here. I'll change it to ../../_file_sayhiiiiiiiiiiiii\n\nnote that you can only overwrite files in the folder where the decompile was saved.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213343.jpg)\n#### step4 \nchange the type of this file to style\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213183.jpg)\nmodified to 0E\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213484.jpg)\n#### step5 \n\nAfter saving, re-compress the whole folder into a zip, then change the extension to APK.\n\nopen it with JADX and you can see that it has been changed to a style type.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213864.jpg)\nclick save all\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213119.jpg)\nyou can see the file escaping.\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213746.jpg)\nso we can also construct a  \n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213497.jpg)\nso the classes.dex file is also replaced here\n\n![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213075.jpg)\n\n### PoC\nthe details above have been written\n\n### Impact\nlatest version \n","status":"published","published":"2024-04-22T15:56:04Z","modified":"2024-12-05T05:30:54.038832Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}