CVE Vulnerabilities

CVE-2021-21381

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Mar 11, 2021 | Modified: Dec 23, 2023
CVSS 3.x
8.2
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 2.x
5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the file forwarding feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the apps permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak apps .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit Disallow @@ and @@U usage in desktop files. The follow-up commits dir: Reserve the whole @@ prefix and dir: Refuse to export .desktop files with suspicious uses of @@ tokens are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Flatpak Flatpak 0.9.4 *

Potential Mitigations

References