CVE-2021-21381
published 2021-03-11CVE-2021-21381: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2…
PriorityP339high8.2CVSS 3.1
AVLACLPRNUIRSCCHIHAN
EPSS
1.55%
71.9th percentile
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | flatpak | < flatpak 1.10.1-4 (bookworm) | flatpak 1.10.1-4 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| flatpak | flatpak | — | — |
| flatpak | flatpak | >= 0 < 1.10.1-4 | 1.10.1-4 |
| flatpak | flatpak | >= 0 < 1.10.1-4 | 1.10.1-4 |
| flatpak | flatpak | >= 0 < 1.10.1-4 | 1.10.1-4 |
| flatpak | flatpak | >= 0 < 1.10.1-4 | 1.10.1-4 |
| flatpak | flatpak | >= 0.9.4 < 1.10.2 | 1.10.2 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv8.2HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2021-21381: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
osv·2021-03-11·CVSS 8.2
CVE-2021-21381 [HIGH] CVE-2021-21381: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @
Ubuntu
Flatpak vulnerability
vendor_ubuntu·2021-05-12
CVE-2021-21381 Flatpak vulnerability
Title: Flatpak vulnerability
Summary: A Flatpak application could access files that it would not normally
be permitted to access.
Anton Lydike discovered that Flatpak did not properly handle special tokens
in desktop files. An attacker could use this to specially craft a Flatpak
application that could escape sandbox confinement.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
flatpak: "file forwarding" feature can be used to gain unprivileged access to files
vendor_redhat·2021-03-09·CVSS 7.1
CVE-2021-21381 [HIGH] CWE-284 flatpak: "file forwarding" feature can be used to gain unprivileged access to files
flatpak: "file forwarding" feature can be used to gain unprivileged access to files
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow
Debian
CVE-2021-21381: flatpak - Flatpak is a system for building, distributing, and running sandboxed desktop ap...
vendor_debian·2021·CVSS 7.1
CVE-2021-21381 [HIGH] CVE-2021-21381: flatpak - Flatpak is a system for building, distributing, and running sandboxed desktop ap...
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb6a5d961https://github.com/flatpak/flatpak/commit/a7401e638bf0c03102039e216ab1081922f140aehttps://github.com/flatpak/flatpak/commit/eb7946bb6248923d8c90fe9b84425fef97ae580dhttps://github.com/flatpak/flatpak/pull/4156https://github.com/flatpak/flatpak/releases/tag/1.10.2https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpphttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MXXLXC2DPJ45HSMTI5MZYHMYEGQN6AA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXNVFOIB6ZP4DGOVKAM25T6OIEP3YLGV/https://security.gentoo.org/glsa/202312-12https://www.debian.org/security/2021/dsa-4868https://github.com/flatpak/flatpak/commit/8279c5818425b6812523e3805bbe242fb6a5d961https://github.com/flatpak/flatpak/commit/a7401e638bf0c03102039e216ab1081922f140aehttps://github.com/flatpak/flatpak/commit/eb7946bb6248923d8c90fe9b84425fef97ae580dhttps://github.com/flatpak/flatpak/pull/4156https://github.com/flatpak/flatpak/releases/tag/1.10.2https://github.com/flatpak/flatpak/security/advisories/GHSA-xgh4-387p-hqpphttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MXXLXC2DPJ45HSMTI5MZYHMYEGQN6AA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXNVFOIB6ZP4DGOVKAM25T6OIEP3YLGV/https://security.gentoo.org/glsa/202312-12https://www.debian.org/security/2021/dsa-4868
2021-03-11
Published