Rapid7 Vulnerability & Exploit Database

CentOS Linux: CVE-2021-21381: Important: flatpak security update (Multiple Advisories)

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

CentOS Linux: CVE-2021-21381: Important: flatpak security update (Multiple Advisories)



Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`.


  • centos-upgrade-flatpak
  • centos-upgrade-flatpak-builder
  • centos-upgrade-flatpak-debuginfo
  • centos-upgrade-flatpak-debugsource
  • centos-upgrade-flatpak-devel
  • centos-upgrade-flatpak-libs
  • centos-upgrade-flatpak-libs-debuginfo
  • centos-upgrade-flatpak-selinux
  • centos-upgrade-flatpak-session-helper
  • centos-upgrade-flatpak-session-helper-debuginfo
  • centos-upgrade-flatpak-tests-debuginfo

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center