jadx Zip Path Traversal Vulnerability Leading to Arbitrary File Overwrite and Remote Code Execution

A vulnerability in jadx versions 1.5.2 through 1.5.5 allows a malicious .xapk file to cause arbitrary file overwriting. This occurs because the XApkLoader resolves ZIP entry names directly to the temporary directory after a security check, potentially leading to exploitation. When jadx is launched from a directory that is an ancestor of the config directory, this vulnerability can be exploited to execute arbitrary code by planting a JAR file in the plugins/dropins directory, which is loaded as a plugin on the next run of jadx.

Impact

Exploitation of this vulnerability allows for arbitrary file overwriting, with the potential for remote code execution by planting a malicious JAR file that is executed as a plugin in jadx.

Reproduction

The vulnerability can be reproduced by creating a .xapk file that includes an absolute path entry pointing to the jadx plugins dropins directory. After extracting this .xapk with the vulnerable version of jadx, the planted JAR will be executed as a plugin on the next run of the application.

Remediation

Users can update to jadx version 1.5.6, which addresses this vulnerability by rejecting absolute paths and normalizing entry names before extraction.