taptap/cve-2025-59489Automated scanner that detects Unity runtime injection vulnerability CVE-2025-59489 in Android APKs by extracting Unity version and checking against patched versions, with batch processing and CI/CD integration.
An automated detection tool for Unity Runtime injection vulnerabilities, specifically designed for Android game platforms.
In one sentence: An attacker can gain complete control over affected Unity games/applications, obtaining all permissions granted to the application.
Key Point: On Android, a malicious app can hijack permissions already granted to a Unity application
Key Point: On Windows, if the game registers a custom URI handler, clicking a specially crafted link can trigger the vulnerability
Good news: Attackers cannot exceed the application's own permission boundaries
Bad news: Many games require extensive permissions (camera, microphone, storage, location, etc.), and attackers can fully exploit these permissions
As an Android game platform operator, the worst consequences:
[Source: Unity official security advisory, GMO Flatt Security technical analysis]
# Only requires Python 3.7+ standard library, no additional dependencies
python3 --version # Verify Python version
# Step 1: Run the tests
python test_demo.py
# Step 2: Check a single APK
python unity_vulnerability_checker.py your_game.apk
# Step 3: Batch check
python unity_vulnerability_checker.py --batch /path/to/apks
# Step 4: View usage examples
python usage_examples.py
from unity_vulnerability_checker import check_unity_vulnerability
# Check a single APK file
result = check_unity_vulnerability("your_game.apk")
# Method 1: Use convenience properties
if result.is_vulnerable:
print(f"⚠️ Application affected! ({result.version})")
print(f"Recommendation: {result.recommendation}")
elif result.is_safe:
print(f"✅ Application is safe")
print(f"Reason: {result.message}")
else:
print(f"❓ Manual review required")
print(f"Reason: {result.message}")
# Method 2: Use the status field
if result.status == "positive":
print(f"Affected: {result.version}")
from unity_vulnerability_checker import batch_check
# Batch scan a directory
results = batch_check("/path/to/apk/folder")
# Filter affected applications
vulnerable_apps = [
(name, result)
for name, result in results.items()
if result.is_vulnerable
]
print(f"Found {len(vulnerable_apps)} affected applications")
for name, result in vulnerable_apps:
print(f" - {name}: {result.version}")
from unity_vulnerability_checker import UnityVulnerabilityChecker
class MyPlatform:
"""Your game platform system"""
def __init__(self):
self.checker = UnityVulnerabilityChecker()
def check_new_upload(self, apk_path: str) -> bool:
"""Check newly uploaded APK, return whether it can be published"""
result = self.checker.check_apk(apk_path)
if result.is_vulnerable:
# Affected - reject publication
self.notify_developer(
f"Your application is affected by the Unity vulnerability\n"
f"Version: {result.version}\n"
f"Recommendation: {result.recommendation}"
)
return False
elif result.is_safe:
# Safe - approve publication
return True
else:
# Cannot determine - manual review
self.queue_manual_review(apk_path, result.message)
return False
def notify_developer(self, message: str):
"""Notify developer (implement your notification logic)"""
pass
def queue_manual_review(self, apk_path: str):
"""Add to manual review queue (implement your logic)"""
pass
The tool returns three types of results:
Output Examples (single-line concise format):
# Affected application
⚠️ This application is affected by CVE-2025-59489 (Unity 2019.2.6f1)
# Safe application (3 cases)
✅ This application is safe - Not a Unity application
✅ This application is safe - Already patched with Unity patcher tool
✅ This application is safe - Patched version (2019.4.41f1)
# Cannot determine
❓ Cannot determine - Unity application but version extraction failed, possibly packed or obfuscated, manual review recommended
⚠️ File too large to process (1500.0MB, limit 1024MB) - modify MAX_APK_SIZE_MB on line 15 of the code to a larger value
.
├── unity_vulnerability_checker.py # Core module
│ ├─ UnityVulnerabilityChecker class - Vulnerability detection core engine
│ ├─ check_unity_vulnerability() - Simplified detection function
│ ├─ batch_check() - Batch detection functionality
│ └─ Complete version parsing and determination logic
│
├── usage_examples.py # Usage examples
│ ├─ Basic usage examples
│ ├─ Batch detection examples
│ ├─ Platform integration examples
│ ├─ Automated response examples
│ └─ Flask API integration examples
│
├── test_demo.py # Test demo
│ ├─ Version number parsing tests
│ ├─ Version extraction tests
│ ├─ Patch determination tests
│ ├─ APK scanning scenario simulations
│ └─ Performance benchmark tests
│
├── test_version_detection.py # Unit tests (33 test cases)
│
├── README.md # Complete documentation (includes quick start guide)
│
└── CLAUDE.md # Development guidelines
# Single file detection
python unity_vulnerability_checker.py game.apk
# Verbose logging mode
python unity_vulnerability_checker.py game.apk -v
# Batch check a directory
python unity_vulnerability_checker.py --batch /path/to/apk/folder
# Batch check (verbose mode)
python unity_vulnerability_checker.py --batch /path/to/apk/folder -v
from unity_vulnerability_checker import batch_check
results = batch_check("/path/to/apk/directory", verbose=True)
# Filter affected applications
vulnerable = {name: result for name, result in results.items()
if result.is_vulnerable}
print(f"Found {len(vulnerable)} affected applications")
from unity_vulnerability_checker import UnityVulnerabilityChecker
class AppReviewSystem:
def __init__(self):
self.checker = UnityVulnerabilityChecker(verbose=False)
def review_upload(self, apk_path: str) -> str:
result = self.checker.check_apk(apk_path)
if result.is_vulnerable:
return "REJECT" # Reject publication
elif result.is_safe:
return "APPROVE" # Approve
else:
return "MANUAL_REVIEW" # Manual review
reviewer = AppReviewSystem()
decision = reviewer.review_upload("new_game.apk")
from flask import Flask, request, jsonify
from unity_vulnerability_checker import check_unity_vulnerability
app = Flask(__name__)
@app.route('/api/scan', methods=['POST'])
def scan_apk():
file = request.files['file']
temp_path = f"/tmp/{file.filename}"
file.save(temp_path)
result = check_unity_vulnerability(temp_path)
# Use the to_dict() method to convert directly to JSON
response = result.to_dict()
response["filename"] = file.filename
response["vulnerable"] = result.is_vulnerable
return jsonify(response)
┌─────────────────┐
│ Read APK file │
└────────┬─────────┘
│
▼
┌─────────────────┐
│ Is it a Unity app? │──NO──> negative
└────────┬─────────┘
│ YES
▼
┌─────────────────────┐
│ Patcher patch detected? │──YES──> negative
└────────┬─────────────┘
│ NO
▼
┌─────────────────┐
│ Extract Unity version │──Failed──> inconclusive
└────────┬─────────┘
│ Success
▼
┌─────────────────┐
│ Version < 2017.1 ? │──YES──> negative
└────────┬─────────┘
│ NO
▼
┌─────────────────┐
│ Version patched? │──YES──> negative
└────────┬─────────┘
│ NO
▼
positive
Checks whether the APK contains the following characteristics:
lib/*/libunity.so - Unity runtime libraryassets/bin/Data/* - Unity resource filesExtracts the Unity version number from the following locations:
Supported version number formats:
2019.4.40f1, 2022.3.15f16000.0.23f1, 6000.2.6f22019.4.40, 6000.0.23Based on rules from the Unity official security advisory:
Automatically scan before app publication, reject affected applications
from unity_vulnerability_checker import check_unity_vulnerability
def pre_publish_check(apk_path):
result = check_unity_vulnerability(apk_path)
if result.is_vulnerable:
return {
"approved": False,
"reason": f"CVE-2025-59489 vulnerability detected ({result.version})",
"recommendation": result.recommendation
}
return {"approved": True, "message": result.message}
Batch scan the existing application library to identify applications requiring updates
python unity_vulnerability_checker.py --batch /data/published_apps > scan_report.txt
Daily scheduled scanning of newly uploaded applications with automatic developer notification
import schedule
from unity_vulnerability_checker import batch_check
def daily_scan():
results = batch_check("/data/new_uploads")
vulnerable = [(name, result) for name, result in results.items() if result.is_vulnerable]
if vulnerable:
# Send notification with detailed information
for name, result in vulnerable:
send_notification(name, result.version, result.message)
schedule.every().day.at("02:00").do(daily_scan)
Generate platform security reports with vulnerability distribution statistics
from unity_vulnerability_checker import batch_check
import json
results = batch_check("/data/all_apps")
report = {
"total": len(results),
"vulnerable": sum(1 for r in results.values() if r.is_vulnerable),
"safe": sum(1 for r in results.values() if r.is_safe),
"unclear": sum(1 for r in results.values() if r.is_uncertain),
# Detailed list
"vulnerable_apps": [
{"name": name, "version": r.version, "message": r.message}
for name, r in results.items() if r.is_vulnerable
]
}
with open("security_report.json", "w") as f:
json.dump(report, f, indent=2)
Integrate into continuous integration pipelines for automated security checks
#!/bin/bash
# Use in CI pipeline
python unity_vulnerability_checker.py build/output.apk
result=$(python unity_vulnerability_checker.py build/output.apk | grep "Detection result")
if echo "$result" | grep -q "positive"; then
echo "Security check failed: CVE-2025-59489 detected"
exit 1
fi
echo "Security check passed"
Cases that may be incorrectly classified as safe:
Cases that may be incorrectly classified as affected:
inconclusive results, manual review is recommendedPossible reasons:
Recommendation: Perform manual review for such applications
Unity has not provided security patches for versions 2017.1-2018.4. These versions are indeed vulnerable, but because:
Therefore "inconclusive" is returned instead of "positive", with the following recommendations:
Based on rules from the Unity official advisory, accuracy for standard-built APKs is > 95%. Obfuscated or packed APKs may require additional processing.
Single APK detection typically completes within 0.5-2 seconds, with support for parallel batch processing to improve efficiency. Detailed performance metrics can be found in the "Performance Metrics" section of this document.
The current version focuses on Android APKs. iOS .ipa file detection requires additional adaptation.
Modify the PATCHED_VERSIONS dictionary in unity_vulnerability_checker.py, and monitor Unity's official advisory for the latest information.
Act Immediately
Continuous Monitoring
User Notification
Upgrade Unity Version
Temporary Solutions (when upgrade is not possible)
Verify the Fix
positiveEncountering issues?
test_demo.py to verify the tool works correctlyusage_examples.py for similar scenariosThe project includes complete code quality checking tools:
# Install dependencies
pip install ruff pre-commit
# Install pre-commit hooks
pre-commit install
# Manually run all checks
pre-commit run --all-files
The following checks run automatically before every commit:
Ruff Linter - Python code static analysis
Ruff Formatter - Python code formatting
General File Checks
Markdown Format Checks
ruff.toml - Ruff configuration.pre-commit-config.yaml - Pre-commit hooks configurationAll code must pass ruff checks before committing. If checks fail, the commit will be blocked.
# If pre-commit fails, some issues will be auto-fixed
# After fixing, re-run git add and commit
git add .
git commit -m "your message"
# Check Python files only
ruff check *.py
# Auto-fix issues
ruff check --fix *.py
# Format code
ruff format *.py
major >= 2019 or major >= 6000)This tool is intended for security auditing and compliance checking purposes only.
| If the game has this permission | The attacker can |
|---|
| 📸 Camera | Secretly record you |
| 🎤 Microphone | Eavesdrop on you |
| 📍 Location | Track you |
| 📱 Contacts | Steal your address book |
| 💾 Storage | Read/delete your files |
| 💰 Payments | Fraudulently use in-game payments |
| 🔐 Account | Steal game accounts |
| Unity Version | Minimum Patched Version | Status |
|---|
| 6000.3 | 6000.3.0b4 | ✅ Patch available |
| 6000.2 | 6000.2.6f2 | ✅ Patch available |
| 6000.0 LTS | 6000.0.58f2 | ✅ Patch available |
| 2022.3 | 2022.3.62f2 | ✅ Patch available |
| 2021.3 | 2021.3.45f2 | ✅ Patch available |
| 2020.x | 2020.1.18f1+ | ✅ Patch available |
| 2019.x | 2019.1.15f1+ | ✅ Patch available |
| 2017-2018 | N/A | ⚠️ No official patch, upgrade recommended |