## https://sploitus.com/exploit?id=76933568-46F0-5D93-9A29-7C7392C52CE8
# Unity CVE-2025-59489 Vulnerability Detection Tool
Automated detection tool for Unity Runtime injection vulnerabilities for the Android game platform.
## Vulnerability Overview
- **CVE ID**: CVE-2025-59489
- **CVSS Score**: 8.4 (High)
- **Scope**: Android apps built with Unity 2017.1 and later.
- **Official Notice**.
## Vulnerability Hazards in Detail
### Hazard limit (worst case scenario)
**Summary**: An attacker can take full control of an affected Unity game/application and get all the permissions of the app.
### Android Platform Harm Scenario
1. A malicious application A** is installed on the user's phone. 2.
2. There is another **affected Unity game B** on the user's phone. 3.
3. Malicious application A can:
- **Impersonate game B and execute arbitrary code** **Steal game B's ability to access
- **steal all data that Game B has access to** (archives, account information, photos, contacts, etc.)
- **Use all permissions of Game B** (camera, microphone, location, networking, etc.)
**Key point**: on Android, a malicious app can hijack permissions already granted to Unity apps
### Windows Platform Harm Scenarios
1. A user clicks on a link to a **malicious web page**. 2.
2. If an affected Unity game is installed on the computer** 3.
3. The attacker can:
- **Remotely trigger the game to load malicious code** **Remote the game to load malicious code
- **Execute arbitrary actions with the game's privileges** **The attacker can
- **steal files and data that the game has access to
**Key point**: On Windows, if the game registers a custom URI handler, clicking on a specially crafted link can trigger the exploit.
### Example of a specific vulnerability
| If the game has this privilege | an attacker can |
| ------------------ | ----------------- |
| πΈ Camera | Eavesdrop you |
| π€ microphone | eavesdrop on you |
| π Location | Track you |
| π± Contacts | Steal your contacts |
| πΎ Storage | Read/delete your files |
| π° Payments | Steal in-game payments |
| π Accounts | Steal game accounts |
### Important restrictions
**Good news**: attackers **cannot** break through the permission boundaries of the **app itself
- β **Can't get root privileges**
- β **Can't access other apps' data** (Android sandbox protection)
- β **Can only act as the attacked app**
**Bad news**: many games ask for a lot of permissions (camera, microphone, storage, location, etc.), which can be fully exploited by an attacker
### Impact on gaming platforms
Worst consequences as an Android game platform operator:
1. **User privacy leakage** β platform reputation damaged
2. **Massive account theft** β Loss of users
3. **Legal liability** β Failure to fulfill security review obligations
4. **Economic loss** β User claims, regulatory penalties
_\[Source: Unity Official Security Bulletin, GMO Flatt Security Technical Analysis\]_
## Quick Start
### Environment requirements
```bash
# Only Python 3.7+ standard libraries are required, no additional dependencies needed.
python3 --version # Confirm Python version.
```
### 5 minutes to get started
```bash
# Step 1: Run the test
python test_demo.py
# Step 2: Check a single APK
python unity_vulnerability_checker.py your_game.apk
# Step 3: Batch testing
python unity_vulnerability_checker.py --batch /path/to/apks
# Step 4: View usage examples
python usage_examples.py
``
### The simplest usage
``## python
from unity_vulnerability_checker import check_unity_vulnerability
## Check a single APK file
result = check_unity_vulnerability("your_game.apk")
if result == "positive": print(" application!
print("β οΈ application is affected! Suggest taking it down or notifying the developer of an update")
elif result == "negative": print("β App Security")
print("β App is safe")
elif result == "negative": print("β App is safe")
print("β Manual review required")
``
### Batch detect all APKs in the directory
``` python
from unity_vulnerability_checker import batch_check
## Batch scan a directory
results = batch_check("/path/to/apk/folder")
# Filter for affected apps
vulnerable_apps = [name for name, status in results.items() if status == "positive"]
print(f "Found {len(vulnerable_apps)} affected apps")
``
### Integration into existing systems
``#python
from unity_vulnerability_checker import UnityVulnerabilityChecker
class MyPlatform.
"""Your game platform system""""
def __init__(self).
self.checker = UnityVulnerabilityChecker()
def check_new_upload(self, apk_path: str) -> bool.
"""Checks for newly uploaded APKs and returns whether they are ready to be shelved.""""
result = self.checker.check_apk(apk_path)
if result == "positive".
# Affected - denied for shelving
self.notify_developer("Your app is affected by the Unity vulnerability, please update")
return False
elif result == "negative".
# Secure - Approved
return True
else.
# Unsure - manual review
self.queue_manual_review(apk_path)
return False
def notify_developer(self, message: str).
"""Notify developer (implement your notification logic)""""
pass
def queue_manual_review(self, apk_path: str).
"""Add to the manual review queue (implement your logic)""""
pass
``
### Explanation of test results
The tool returns three types of results:
- **positive** - confirmed affected (needs to be updated)
- **negative** - safe (not Unity or fixed)
- **inconclusive** - Unable to determine (manual review required)
## List of project files
```text
.
βββ unity_vulnerability_checker.py # Core modules
β ββ UnityVulnerabilityChecker class - core vulnerability checking engine
β ββ check_unity_vulnerability() - simplified detection function
β ββ batch_check() - batch detection function
β ββ Complete version parsing and determination logic
β
ββ usage_examples.py # usage examples
β ββ Basic usage examples
β ββ Batch Inspection Examples
β ββ Platform Integration Examples
β ββ Automated Response Examples
β ββ Flask API Integration Examples
β
ββ test_demo.py # Test Demo
β ββ Version number parsing test
β ββ Version extraction test
β ββ Repair judgment test
β ββ APK scanning scenario simulation
β ββ Performance benchmarking
β
βββ README.md # Full documentation (with quick start guide)
β
βββ PROJECT_OVERVIEW.txt # Project Overview β βββ PROJECT_OVERVIEW.txt # Project Overview
``
## Core functionality
### APK detection
- Automatically recognize Unity applications
- Extract Unity version number
- Determines if the application is affected by CVE-2025-59489.
- Returns three types of results: positive, negative, and inclusive.
### Batch processing
- Supports batch scanning of directories.
- Generate statistical reports
- Suitable for large-scale application audits
### Easy to integrate
- Simple API interface
- Command line tools
- Can be embedded into existing systems
## User's Guide
### Command Line Usage
```bash
## Single file detection
python unity_vulnerability_checker.py game.apk
# Detailed logging mode
python unity_vulnerability_checker.py game.apk -v
# Batch testing directory
python unity_vulnerability_checker.py --batch /path/to/apk/folder
# Batch detection (detailed mode)
python unity_vulnerability_checker.py --batch /path/to/apk/folder -v
``
### Batch scan and generate report
``` python
from unity_vulnerability_checker import batch_check
results = batch_check("/path/to/apk/directory", verbose=True)
# Filter for affected apps
vulnerable = {name: status for name, status in results.items()
if status == "positive"}
print(f "Found {len(vulnerable)} affected applications")
``
### Integration into the audit system
``#python
from unity_vulnerability_checker import UnityVulnerabilityChecker
class AppReviewSystem.
def __init__(self).
self.checker = UnityVulnerabilityChecker(verbose=False)
def review_upload(self, apk_path: str) -> str.
result = self.checker.check_apk(apk_path)
if result == "positive".
return "REJECT" # Reject the upload.
elif result == "negative": return "APPROVE" # Approve
return "APPROVE" # Approve
else: return "MANUAL_REVIEW
return "MANUAL_REVIEW" # manual review
reviewer = AppReviewSystem()
decision = reviewer.review_upload("new_game.apk")
``
### Flask API integration
```python
from flask import Flask, request, jsonify
from unity_vulnerability_checker import check_unity_vulnerability
app = Flask(__name__)
@app.route('/api/scan', methods=['POST'])
def scan_apk().
file = request.files['file']
temp_path = f"/tmp/{file.filename}"
file.save(temp_path)
result = check_unity_vulnerability(temp_path)
return jsonify({
"filename": file.filename, "vulnerable": result == "positive", result == "positive
"vulnerability": result == "positive",
"status": result
})
``
## Detection principle
### Detection logic flow chart
Γ Γ Γ Γ Γ Γ Γ Γ Γ Γ Γ Γ Γ Γ Text
βββββββββββββββββββ
β Read APK file β
ββββββββββ¬Β₯ββββββββββ
β
βΌ
βββββββββββββββββββ
β Is it a Unity application? ββNOββ> negative
ββββββββββ¬Β₯ββββββββββ
β YES
βΌ
βββββββββββββββββββ
β Extract Unity version βββfailβ> inconclusive
ββββββββββ¬ββββββββββ
β Success
βΌ
βββββββββββββββββββ
β Version negative
ββββββββββ¬ββββββββββ
β NO
βΌ
βββββββββββββββββββ
β Version fixed? βββYESββ> negative
ββββββββββ¬Β₯ββββββββββ
β NO
βΌ
positive
```
### 1. Unity Application Recognition
Detects the presence of the following features in the APK:
- `lib/*/libunity.so` - Unity runtime libraries
- `assets/bin/Data/*` - Unity resource files
### 2. Version Extraction
Extract the Unity version number from the following location:
- **libunity.so** - the version string in the binary library
- **globalgamemanagers** - Unity data files
- **data.unity3d** - packaged resource files
Supported version number formats:
- Standard format: `2019.4.40f1`, `2022.3.15f1`.
- New formats: `6000.0.23f1`, `6000.2.6f2`
- No suffix: `2019.4.40`, `6000.0.23`
### 3. Vulnerability determination
Based on the rules of Unity's official security bulletin:
1. before Unity 2017.1 β **Security**.
2. Fixed versions β **Security**
3. Unity 2017.1-2018.4 β **affected** (no patch)
4. Unity 2019.1+ unfixed β **affected** (patch available)
### Fixed version comparison table
| Unity Version | Minimum Fix Version | Status |
| ---------- | ------------ | --------- |
| 6000.3 | 6000.3.0b4 | β Patch available | 6000.2 | 6000.2.6f2
| 6000.2 | 6000.2.6f2 | β With Patch | 6000.0 LTS
| 6000.0 LTS | 6000.0.58f2 β β With patch | 6000.2 | 6000.2.6f2 β With patch | 6000.2.6f2 β With patch
| 2022.3 | 2022.3.62f2 β β With Patch | 2021.3 | 2022.3.62f2 β With Patch
| 2021.3 | 2021.3.45f2 β With patch | 2020.x | 2021.3.45f2 β With patch | 2021.3.45f2 β With patch
| 2020.x | 2020.1.18f1+ | β With Patch | 2021.3 | 2021.3.45f2 β With Patch
| 2019.x | 2019.1.15f1+ | β With patch |
| 2017-2018 | N/A | β No Patch |
## Practical application scenarios
### Scenario 1: App Store Review
Automatically scan apps before they hit the store shelves and reject affected apps.
``python
from unity_vulnerability_checker import check_unity_vulnerability
def pre_publish_check(apk_path):
result = check_unity_vulnerability(apk_path)
if result == "positive": return {"approved": False
return {"approved": False, "reason": "CVE-2025-59489 vulnerability detected"}
return {"approved": True}
```
### Scenario 2: Inventory Application Scanning
Batch scan the existing application library to identify applications that need to be updated.
```bash
python unity_vulnerability_checker.py --batch /data/published_apps > scan_report.txt
```
### Scenario 3: Automated Monitoring
Scan for newly uploaded apps on a daily basis and notify developers automatically
``python
import schedule
from unity_vulnerability_checker import batch_check
def daily_scan(): results = batch_check("/data/new_uploads")
results = batch_check("/data/new_uploads")
vulnerable = [name for name, status in results.items() if status == "positive"]
if vulnerable.
send_notification(vulnerable)
schedule.every().day.at("02:00").do(daily_scan)
``
### Scenario 4: Security Report Generation
Generate a platform security report with statistics on the distribution of vulnerabilities
``python
from unity_vulnerability_checker import batch_check
import json
results = batch_check("/data/all_apps")
report = {
"total": len(results), "vulnerable": sum(results), "total": sum(results), "vulnerable": sum(results)
"vulnerable": sum(1 for s in results.values() if s == "positive"), "safe": sum(1 for s in results.values()), "safe": sum(1 for s in results.values())
"safe": sum(1 for s in results.values() if s == "negative"), "unclear".
"unclear": sum(1 for s in results.values() if s == "inconclusive")
}
with open("security_report.json", "w") as f.
json.dump(report, f, indent=2)
``.
### Scenario 5: CI/CD Integration
Integration into Continuous Integration Process, Automated Security Checks
```bash''
/bin/bash /bin/bash
# Use in CI pipeline
python unity_vulnerability_checker.py build/output.apk
result=$(python unity_vulnerability_checker.py build/output.apk | grep "test result")
if echo "$result" | grep -q "positive"; then
echo "Security check failed: CVE-2025-59489 detected"
exit 1
exit 2. f
echo "Security check passed"
```
## Performance metrics
- **Single file detection**: 0.5 - 2 seconds (depending on APK size)
- **Version resolution**: 95%. Obfuscated or shelled APKs may require additional processing.
### What is the performance?
Single APK detection is usually completed within 0.5-2 seconds, and parallel batch processing is supported to improve efficiency. Detailed performance metrics can be found in the "Performance Metrics" section of this document.
### Can iOS apps be inspected?
The current version focuses on Android APKs. iOS .ipa file detection requires additional adaptations.
### How do I update the list of fixes?
Modify the `PATCHED_VERSIONS` dictionary in `unity_vulnerability_checker.py` and follow Unity's official announcements for the latest information.
## Security Recommendations
### Platform
1. **Immediate action**
- Take down affected apps or restrict downloads
- Notify developers to update as soon as possible
2. **Continuous monitoring**
- Establish daily automatic scanning mechanism
- Monitor newly uploaded applications
3. **User notification**
- Push update alerts to installed users
- Provide vulnerability descriptions and remediation guidelines
### Developer
1. **Upgrade Unity version
- Update to the latest fix
- Recompile and publish the application
2. **Interim Program** (when upgrade is not possible)
- Use Unity Application Patcher
- Replace the affected runtime libraries
3. **Verify Fix**
- Verify the new version with this tool
- Verify that it is no longer reported as `positive
## Related links
- **Unity Official Announcement**.
- **Fix download**.
- **CVE Details**.
- **Technical Analysis** (GMO Flatt Security).
## Technical Support
Problems?
1. Review this document for detailed instructions
2. Run `test_demo.py` to verify that the tool is working.
3. Check `usage_examples.py` for similar scenarios.
4. Contact Unity for the latest information
## Developer's Guide
### Environment Configuration
The project has been configured with a complete code quality checking tool:
``bash''
## Install dependencies
pip install ruff pre-commit
# Install pre-commit hooks
pre-commit install
# Run all checks manually
pre-commit run --all-files
``
### Code quality standards
The following checks are automatically run before all commits:
1. **Ruff Linter** - Python Code Static Analysis
- Checking code style (PEP 8)
- Detects potential errors
- Automatically fixes common problems
2. **Ruff Formatter** - Python Code Formatting
- Unified code formatting
- 88 character line length limit
3. **General File Check** - Python code formatting
- Clear end-of-line spaces
- End-of-file line feeds
- YAML/TOML format validation
- Detect large files (>1MB)
- Detect merge conflict flag
4. **Markdown formatting check**
- Automatically fixes formatting problems
- Check for code block language markup
### Configuration file
- `ruff.toml` - Ruff configuration
- `.pre-commit-config.yaml` - Pre-commit hooks configuration
### Pre-commit checks
All code **must** pass a ** ruff check before being committed. If the check fails, the commit will be blocked.
```bash
# If pre-commit fails, some of the problems are fixed automatically
# After fixing it, you need to git add and commit again
git add .
git commit -m "your message"
```
### Run the checkout manually
```bash
## Check Python files only
ruff check *.py
# Automatically fix problems
ruff check --fix *.py
# Format the code
ruff format *.py
``
## Update log
### v1.1.0 (2025-10-11)
- Fix version determination logic error (`major >= 2019 or major >= 6000`)
- Support beta/alpha version number parsing and comparison.
- Stricter rules for Unity app identification
- Add file size validation (500MB limit).
- Implement parallel batch processing
- Change to standard logging module
- Change to argparse for parsing command line arguments.
- Extract magic numbers as constants
- Configure pre-commit hooks and ruff linter.
- All code passes ruff quality checks
### v1.0.0 (2025-10-11)
- Initial release
- Support Unity 2017.1 - 6000.x version detection
- Support batch scanning function
- Command Line Interface
- Based on Unity CVE-2025-59489 official announcement
## License
This tool is intended for security audits and compliance checks only.