Ackites KillWxapkg wxapkg File Parser unpack.go processFile os command injection

Vulnerability

Description The vulnerability is located in the processFile function within internal/unpack/unpack.go of the Ackites KillWxapkg tool (versions up to 2.4.1). The software, which is used for automated decompilation and security assessment of WeChat Mini Programs, improperly validates input during wxapkg file parsing. This lack of sanitization leads to OS command injection, meaning an attacker can inject arbitrary operating system commands that are executed in the context of the user running the tool [1][3].

Exploitation

Analysis An attacker can exploit this vulnerability remotely by providing a maliciously crafted wxapkg file to the victim. The attack complexity is rated as high, and exploitation is considered difficult, likely due to the need for a specifically crafted payload that bypasses any rudimentary checks. The official issue report demonstrates a proof-of-concept that includes arbitrary file write via path traversal (e.g., writing files outside the intended extraction directory) which can be leveraged to achieve command execution [2][3]. The attack does not require authentication beyond the victim opening the malicious file with KillWxapkg.

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands on the target system. This can lead to complete compromise of the affected machine, including data theft, installation of malware, or further lateral movement within a network. Since KillWxapkg is often used in security assessments and development environments, the impact is heightened in those contexts [2][3].

Mitigation

Status As of the publication date, the version 2.4.1 remains unpatched. No official fix or workaround has been released by the vendor. Users are advised to consider temporarily suspending use of the tool, or to exercise extreme caution by not opening untrusted wxapkg files. The exploit code has been publicly disclosed, increasing the risk of active exploitation [1][3].