JADX file override vulnerability
Date: 2024-04
Affected: maven/io.github.skylot:jadx-core
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Low
CWE: CWE-22
CVSS: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

### Summary when jadx parses a resource file, there is an escape problem with the style file, which can overwrite other files in the directory when saving the decompile result. Although I don't think this vulnerability realizes path traversal in the true sense of the word , I reported it anyway ### Details I see that getResAlias does something with the filename. ```java private String getResAlias(int resRef, String origKeyName, @Nullable FieldNode constField) { ``` but type style will return the original filename directly. ![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212491.jpeg) so our goal is to take a malicious file that was originally of type raw, modify its type to style, trick jadx into #### step1 create an android project using androidstudio and create a raw folder with the name attack_file_sayhiiiiiiiiiiiii, it doesn't matter what the content is! ![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212073.jpg) generate an initial APK #### step2 extract this initial APK using ZIP software to get resources.arsc ![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232212841.jpg) drop resources.arsc into 010editor #### step3 search for the previous filename attack_file_sayhiiiiiiiiiiiii , two will appear here, we choose the second one ![img](https://quan9i.oss-cn-beijing.aliyuncs.com/img/202401232213527.jpg) let's change the name of the file here. I'll change it to ../../_file_sayhiiiiiiiiiiiii note that you can only ove


Mitigations:

Architectural layers (MAESTRO):