0.7.1 is already available here: https://www.npmjs.com/package/logkitty
The latest tag in this repo still shows 0.7.0 though.
Please push the latest release tag to the repo. Thanks!

I can't select the device that I want to log

In the example it was a physical device and AVD emulator

✖︎ Ups, something went wrong

CODE ▶︎ ERR_ANDROID_CANNOT_GET_APP_PID
MESSAGE ▶︎ Command failed: adb shell pidof -s co.solarismobile.animal.puzzle
error: more than one device/emulator

I had some trouble getting messages saying that "adb" is not a recognized internal command.

So i had to open the source code to realize that logkitty uses the "ANDROID_HOME" variable.

But according to Android site, ANDROID_HOME is now deprecated in favor of ANDROID_SDK_ROOT.

https://developer.android.com/studio/command-line/variables

Also would be good to improve the error message saying where is logkitty looking for, since google results says to set the Path variable.

This package uses [email protected] which contains a vulnerable dependency: zamotany/ansi-fragments#21

When a new version of ansi-fragments is released, it should be updated.

This issue has been generated on-behalf of Mik317 (https://huntr.dev/app/users/Mik317)

Details

I would like to report a RCE issue in the logkitty module.
It allows to execute arbitrary commands remotely inside the victim's PC

Vulnerability Description

The issue occurs because a user input is formatted inside a command that will be executed without any check. The issue arises here: https://github.com/zamotany/logkitty/blob/master/src/android/adb.ts#L55

Steps To Reproduce

1. Check there aren't files called HACKED.
2. Execute the following commands in another terminal:

npm i logkitty # Install affected module
logkitty android app 'test; touch HACKED' #  Note the *touch command* is inside the *'* (single quote), so it's an argument, while it will be executed anyway

3. Recheck the files: now HACKED has been created.

Bug Bounty

We have opened up a bounty for this issue on our bug bounty platform. Want to solve this vulnerability and get rewarded 💰? Go to https://huntr.dev/

Roadmap

• support for multiple Android devices
• support for iOS devices