Ackites KillWxapkg OS Command Injection Vulnerability in wxapkg File Parser

A critical vulnerability exists in Ackites KillWxapkg versions through 2.4.1, specifically within the wxapkg file parser component. The issue arises in the processFile function of internal/unpack/unpack.go, where improper validation of wxapkg files allows for OS command injection. This vulnerability can be exploited remotely, although the attack's complexity is considered high, requiring user interaction.

Impact

Exploitation of this vulnerability leads to OS command injection, allowing attackers to execute arbitrary commands on the host system.

Reproduction

The vulnerability can be reproduced by creating a malicious wxapkg file that exploits the flawed validation in the parsing process. This crafted file can be designed to write arbitrary data to the file system and potentially execute commands, depending on the context.

Remediation

It is recommended to implement strict path sanitization when extracting wxapkg files to prevent arbitrary file write and command execution vulnerabilities.