Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6.

appium-desktop v1.14.1 and prior is vulnerable to OS Command Injection.

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc, resource-id, and locator selector values — directly into an HTML template literal without any HTML or JavaScript context escaping. An attacker who controls the UI of the app under test can inject arbitrary HTML and JavaScript into the MCP UI resource returned by the generatelocators tool. When a victim's MCP client renders this resource, the injected script executes and can invoke arbitrary MCP tools via window.parent.postMessage, leading to unauthorized MCP tool execution such as taking screenshots, reading page source, or any other registered capability. This issue has been fixed in version 1.85.10.

Summary

When directConnect(true) is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEWSESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no host validation, and no user notification.

Affected Code

- AppiumCommandExecutor.java (line 196–219): setDirectConnect() builds a new URL from server-supplied fields and calls overrideServerUrl(newUrl) without validating host/IP. - DirectConnect.java: getUrl() constructs protocol://host:port/path with no allowlist.

Root Cause

Only the protocol is validated (must equal "https"). The destination host and port are never checked against any allowlist or denylist.

PoC (confirmed)

A rogue server injecting directConnectHost=127.0.0.1:4443 causes the client to silently redirect all post-session commands:

[bootstrap] POST /wd/hub/session [bootstrap] Injecting directConnect -> https://127.0.0.1:4443/wd/hub [redirect-target] HIT #1: GET /wd/hub/session/poc-session-001/source [redirect-target] HIT #2: DELETE /wd/hub/session/poc-session-001

Original source code unmodified — confirmed via git diff HEAD (empty).

Evidence Screenshots

Screenshot 1 — Rogue server capturing redirected traffic:

<img width="887" height="146" alt="1" src="https://github.com/user-attachments/assets/cc28002c-ea20-4ac8-8336-cec632e3c842" />

Screenshot 2 — Java client processing response from attacker host:

<img width="788" height="130" alt="2" src="https://github.com/user-attachments/assets/222cbab0-0d53-45b2-847d-6aa4e3b79370" />

Impact

- Full interception of session traffic - Network pivot to internal hosts (RFC-1918, 169.254.169.254) - Cloud credential theft via IMDS endpoint - Escalates to ~8.1 High in CI/CD environments where directConnect(true) is set in shared base configuration

Suggested Fix

Add allowlist validation before overrideServerUrl() is called, and/or block RFC-1918/loopback/link-local destinations by default.

pocappiumdirectconnect.zip

Affected versions of appium-chromedriver insecurely download resources over HTTP.

In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution if overwritten with a malicious binary.

Recommendation

Update to version 2.9.4 or later.

Summary

@appium/support contains a ZIP extraction implementation (extractAllTo() via ZipExtractor.extract()) with a path traversal (Zip Slip) check that is non-functional. The check at line 88 of packages/support/lib/zip.js creates an Error object but never throws it, allowing malicious ZIP entries with ../ path components to write files outside the intended destination directory. This affects all JS-based extractions (the default code path), not only those using the fileNamesEncoding option.

Severity

Medium (CVSS 3.1: 6.5)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

- Attack Vector: Network — malicious ZIP files can be supplied over the network (e.g., app packages via URL) - Attack Complexity: Low — no special conditions required beyond providing a crafted ZIP - Privileges Required: None — no authentication needed to supply a malicious archive - User Interaction: Required — a user or automation system must initiate extraction of the attacker's archive - Scope: Unchanged — impact stays within the file system permissions of the Appium process - Confidentiality Impact: None — the vulnerability enables file writes, not reads - Integrity Impact: High — arbitrary file write to any location writable by the process - Availability Impact: None — no direct availability impact

Affected Component

- packages/support/lib/zip.js — ZipExtractor.extract() (line 88) and ZipExtractor.extractEntry() (lines 111-145)

CWE

- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Description

Missing throw renders Zip Slip protection non-functional

The ZipExtractor.extract() method contains a path traversal check intended to prevent Zip Slip attacks. However, the check creates an Error object as a bare expression without the throw keyword, making it a no-op:

javascript // packages/support/lib/zip.js, lines 80-93 const destDir = path.dirname(path.join(dir, fileName)); try { await fs.mkdir(destDir, {recursive: true});

const canonicalDestDir = await fs.realpath(destDir); const relativeDestDir = path.relative(dir, canonicalDestDir);

if (relativeDestDir.split(path.sep).includes('..')) { new Error( // <-- BUG: missing throw Out of bound path "${canonicalDestDir}" found while processing file ${fileName} ); }

await this.extractEntry(entry); // extraction proceeds unconditionally

The presence of a well-formatted error message and surrounding try/catch block (lines 95-99) strongly suggests the throw keyword was accidentally omitted.

yauzl does not provide its own traversal protection

The upstream yauzl library explicitly does not offer path traversal protection regardless of the decodeStrings setting. This means the vulnerability affects all JS-based extractions through ZipExtractor, not only those where fileNamesEncoding is set. The fileNamesEncoding option bypasses yauzl's string decoding (decodeStrings: false), but even with decodeStrings: true, yauzl passes through ../ path components without rejection.

Unprotected write sinks

The extractEntry method writes to attacker-controlled paths with no additional validation:

javascript // packages/support/lib/zip.js, lines 111-145 const fileName = this.extractFileName(entry); const dest = path.join(dir, fileName); // resolves ../pwned.txt outside dir // ... await fs.symlink(link, dest); // symlink creation (line 143) await pipeline(readStream, fs.createWriteStream(dest, {mode: procMode})); // file write (line 145)

Additionally, extractEntryTo() (line 263) used by readEntries() has no traversal check at all:

javascript const dstPath = path.resolve(destDir, entry.fileName); // no validation

Default code path is vulnerable

The extractAllTo() function uses the JS-based ZipExtractor by default. The system unzip fallback (useSystemUnzip: true) must be explicitly enabled and only provides protection if the system binary succeeds:

javascript // packages/support/lib/zip.js, lines 203-210 if (opts.useSystemUnzip) { try { await extractWithSystemUnzip(zipFilePath, dir); return; } catch (err) { log.warn('unzip failed; falling back to JS: %s', err.stderr || err.message); // Falls through to the vulnerable JS implementation } }

Proof of Concept

bash 1) Install deps for the support package cd packages/support npm install --omit=dev --ignore-scripts --no-audit --no-fund --workspaces=false

2) Create a malicious ZIP containing a traversal entry export WORK=/tmp/appiumzipslippoc rm -rf "$WORK" && mkdir -p "$WORK/dest" python3 - <<'PY' import zipfile, os work = os.environ['WORK'] zippath = os.path.join(work, 'evil.zip') with zipfile.ZipFile(zippath, 'w') as z: z.writestr('../pwned.txt', 'ZIPSLIPMARKER') print('created', zippath) PY

3) Extract with the JS implementation (default path, no fileNamesEncoding needed) node --experimental-default-type=module --experimental-specifier-resolution=node - <<'NODE' import path from 'node:path'; import fs from 'node:fs/promises'; import { extractAllTo } from './lib/zip.js';

const work = process.env.WORK; const zipPath = path.join(work, 'evil.zip'); const dest = path.join(work, 'dest');

await extractAllTo(zipPath, dest, { useSystemUnzip: false });

const outside = path.join(work, 'pwned.txt'); console.log('outside exists?', await fs.stat(outside).then(() => true, () => false)); console.log('outside content:', (await fs.readFile(outside, 'utf8')).trim()); NODE Expected output: outside exists? true outside content: ZIPSLIPMARKER

Impact

- Arbitrary file write: An attacker can write files to any location writable by the Appium process, outside the intended extraction directory. - Arbitrary symlink creation: Malicious ZIP entries with symlink attributes can create symlinks pointing to arbitrary targets, enabling further attacks on subsequent file operations. - Potential code execution: By overwriting scripts, configuration files, nodemodules contents, cron jobs, shell profiles, or other executable artifacts, arbitrary file write can chain into remote code execution. - Affects all JS-based extractions: The default code path (without useSystemUnzip: true) is vulnerable regardless of whether fileNamesEncoding is set.

Recommended Remediation

Option 1: Add the missing throw keyword (preferred — minimal fix)

javascript // packages/support/lib/zip.js, line 88 if (relativeDestDir.split(path.sep).includes('..')) { throw new Error( // Add throw Out of bound path "${canonicalDestDir}" found while processing file ${fileName} ); }

This is the lowest-risk fix: it restores the clearly intended behavior of the existing check. The try/catch block at lines 95-99 will catch the error, set canceled = true, close the zip, and reject the promise — exactly the designed error-handling flow.

Option 2: Add traversal protection to extractEntryTo as well

The extractEntryTo function (line 262) also lacks a traversal check. For defense-in-depth, add validation there too:

javascript async function extractEntryTo(zipFile, entry, destDir) { const dstPath = path.resolve(destDir, entry.fileName); const canonicalDest = path.resolve(dstPath); const canonicalDestDir = path.resolve(destDir); if (!canonicalDest.startsWith(canonicalDestDir + path.sep) && canonicalDest !== canonicalDestDir) { throw new Error( Out of bound path "${canonicalDest}" found while processing file ${entry.fileName} ); } // ... rest of function }

Credit

This vulnerability was discovered and reported by bugbunny.ai.

Summary

Appium's base-driver mounts the built-in /test/guinea-pig, /test/guinea-pig-scrollable and /test/guinea-pig-app-banner routes unconditionally on every server. The handler reflects the throwError query param, the comments POST field, and the User-Agent request header into the returned HTML via compileLodashTemplate, which interpolates <%= expr %> as String(expr) with no HTML/JS escaping. This yields reflected XSS, and the throwError value is reflected inside a <script> block, giving arbitrary JavaScript execution on the server's origin. No authentication, no session, no driver and no plugin are required, and the default bind address is 0.0.0.0.

Details

Affected - @appium/base-driver 10.6.0 (with Appium server 3.5.0); tested live. - Template engine helper: @appium/base-driver lib/utils.ts compileLodashTemplate.

Location (file:line) - Routes mounted unconditionally: base-driver/lib/express/server.ts:216-219 (app.all('/test/guinea-pig', guineaPig) etc.). - Tainting: base-driver/lib/express/static.ts:35-61 (guineaPigTemplate) — throwError = String(req.params.throwError ?? req.query?.throwError), params.comment = String(req.body.comments), params.userAgent = req.headers['user-agent']. - Unescaped render: base-driver/lib/utils.ts:67-83 (compileLodashTemplate) emits <%= expr %> as String(${expr}) via new Function(...), no escaping. - Sinks (shipped templates): base-driver/static/test/guinea-pig.html:11-12 (throwError inside <script>), :50 (comment), :87 (userAgent); same in guinea-pig-scrollable.html / guinea-pig-app-banner.html.

PoC

Requests: GET /test/guinea-pig?throwError=x%27%2balert(document.domain)%2b%27 POST /test/guinea-pig (body: comments=</span><img src=x onerror=alert(1)>) GET /test/guinea-pig (header: User-Agent: <script>alert(7)</script>)

<img width="973" height="276" alt="image" src="https://github.com/user-attachments/assets/f58e1dce-f3ad-43d3-b66e-1ff5efea3866" />

Impact

An attacker who can get a victim to open a crafted link (or auto-submit a form) to the Appium server executes arbitrary JavaScript on the server's origin. With default CORS + no authentication, that JS can drive the WebDriver REST API and plugin endpoints. The endpoints are debug/test fixtures that should not be reachable on a production listener at all.