We are a game publishing company that collaborates with multiple game developers. Developers are required to provide us with the AAB file. How can we verify that the provided AAB file has had the specific vulnerability fixed? Currently, we face the following issue: even when the AAB is recompiled using a Unity version that includes the vulnerability fix, and then scanned or processed with a repair tool, the repair tool still reports “repair successful” instead of indicating “no repair needed.” We would like a clear, actionable verification procedure or acceptance criteria to confidently determine that the AAB file is indeed free of the vulnerability.
Can anyone help with this?
Try using unity patch tool
Probably the most bulletproof way is trying to use one of the affected command line arguments (see Unity Security Vulnerability: Developer Remediation Guide) and inject it as an intent into the app. If that fails, the app is patched. If it succeeds, it is not patched.