OS Command Injection in appium/appium-desktop

CVE-2023-2479 describes an OS Command Injection vulnerability in Appium Desktop, a graphical frontend for the Appium automation server. The flaw exists in versions prior to v1.22.3-4, where insufficient input validation allows an attacker to inject arbitrary operating system commands. The vulnerability was identified and reported through the huntr bug bounty platform [4].

Exploitation requires network access to the Appium Desktop service. If the application's open ports are exposed to the wider internet, a remote attacker can send crafted requests that trigger command injection. No authentication is needed for exploitation, making the attack surface particularly dangerous for users who have not properly firewalled their systems [1][3].

Successful exploitation grants the attacker arbitrary command execution on the host system, effectively allowing full remote code execution. This could lead to data theft, malware installation, or complete compromise of the affected machine.

As of this writing, the Appium Desktop project has been deprecated and is no longer maintained. The developers explicitly advise against using it; users should migrate to the command-line Appium server with Appium Inspector [1][3]. No patches are planned, and the project repository has been archived. Affected users should immediately disable or firewall any exposed instances and transition to supported alternatives.