Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS03dmZ4LWhmdm0tcmhyOM4AA24s

cordova-plugin-fingerprint-aio DoS vulnerability

Summary:

Sending a specially crafted intent with an invalid/empty extras de.niklasmerz.cordova.biometric.BiometricActivity can cause the app to crash. sending the intent repeatedly can prevent the app using this plugin from working, resulting in a denial of service (DoS) condition.

Impact

A 3rd party app/remote attacker can exploit this vulnerability by sending a malicious intent to the target device, causing the app using this plugin from working to crash or become unresponsive, resulting in a denial of service (DoS) condition.

Mitigation

Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable.

If you want to fix older versions change the attribute android:exported of this code snippet in plugin.xml to false:

<config-file target="AndroidManifest.xml" parent="application">
      <activity android:name="de.niklasmerz.cordova.biometric.BiometricActivity" android:theme="@style/TransparentTheme" android:exported="false"/>
</config-file>

Patches

Please upgrade to version 5.0.1 as soon as possible.

Please check out the release on GitHub.

For more information

If you have any questions or comments about this advisory please go to the discussion on GitHub.

Permalink: https://github.com/advisories/GHSA-7vfx-hfvm-rhr8
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03dmZ4LWhmdm0tcmhyOM4AA24s
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: about 1 year ago


CVSS Score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00044
EPSS Percentile: 0.13516

Identifiers: GHSA-7vfx-hfvm-rhr8, CVE-2021-43849
References: Repository: https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio
Blast Radius: 15.1

Affected Packages

npm:cordova-plugin-fingerprint-aio
Dependent packages: 5
Dependent repositories: 271
Downloads: 35,777 last month
Affected Version Ranges: < 5.0.1
Fixed in: 5.0.1
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.2.0, 0.3.0, 0.3.1, 0.3.5, 0.3.6, 0.3.7, 0.4.0, 0.5.0, 0.5.1, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.9.0, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.3.7, 1.3.8, 1.4.0, 1.4.1, 1.5.0, 1.6.0, 1.7.0, 2.0.0, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.1.2, 5.0.0
All unaffected versions: 5.0.1, 5.0.2, 5.0.3, 6.0.0