Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

muntashirakon/appmanager

              master @ 133b5ac
            

Fixes

CVEs

HIGH

Peak severity

30.8%

Coverage

Highlights

Auth Bypass: 16 prior fixes. Scrutinize any change in this area.

AndroidManifest.xml: most-fixed (4 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Prior to the migration to a mutual HMAC-SHA256 challenge-response protocol, a static token comparison allowed attackers to bypass authentication entirely on privileged ADB interfaces.

Remote Code Execution: The inclusion of a 'ClassCallerProcessor' API enabled arbitrary remote Java class execution over IPC. This risk was mitigated by removing class-calling features entirely and restricting the server to command-based interactions.

Path Traversal: Unrestricted extraction of tar archives allowed directory traversal and file overwrite via unvalidated symbolic links and unescaped relative paths during restore operations.