Improper Restriction of XML External Entity Reference in skylot/jadx
Date: 2022-01
Affected: maven/io.github.skylot:jadx-core
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-0219
CWE: CWE-611
CVSS: 5.5 (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.


Mitigations:

Architectural layers (MAESTRO):