Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the file forwarding feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the apps permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak apps .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit Disallow @@ and @@U usage in desktop files. The follow-up commits dir: Reserve the whole @@ prefix and dir: Refuse to export .desktop files with suspicious uses of @@ tokens are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Flatpak | Flatpak | 0.9.4 (including) | 1.10.2 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | flatpak-0:1.0.9-11.el7_9 | * |
| Red Hat Enterprise Linux 8 | RedHat | flatpak-0:1.6.2-6.el8_3 | * |
| Red Hat Enterprise Linux 8.1 Extended Update Support | RedHat | flatpak-0:1.0.9-4.el8_1 | * |
| Red Hat Enterprise Linux 8.2 Extended Update Support | RedHat | flatpak-0:1.6.2-5.el8_2 | * |
| Flatpak | Ubuntu | bionic | * |
| Flatpak | Ubuntu | focal | * |
| Flatpak | Ubuntu | groovy | * |
| Flatpak | Ubuntu | trusty | * |
| Flatpak | Ubuntu | upstream | * |