CVE-2022-0219 PoC — Skylot Jadx 代码问题漏洞

Source

https://github.com/Haxatron/CVE-2022-0219

Associated Vulnerability

Title:Skylot Jadx 代码问题漏洞 (CVE-2022-0219)
Description:Skylot Jadx是一个 Dex 到 Java 反编译器。 Skylot Jadx 中存在代码问题漏洞，该漏洞源于产品对XML外部实体引用限制不当。以下产品及版本受到影响：Skylot Jadx 1.3.2 之前版本。

Readme

# CVE-2022-0219

Jadx is vulnerable to Improper Restriction of XML External Entities (CWE-611) when exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle. 

It can lead to local file disclosure when using it from the CLI. When used as a library, it can lead to local file disclosure / denial of service if the APK file can come from an untrusted source. The GUI is not known to be affected.

Original report: https://huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e/

Fixed in [jadx-1.3.2](https://github.com/skylot/jadx/releases/tag/v1.3.2)

File Snapshot


 [4.0K]  /data/pocs/491074c41af29ea545f3db4fc6282d047f3ee872
├── [ 72K]  payload.apk
└── [ 611]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!