CVE-2024-21668

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d	Patch
https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0	Release Notes
https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mrousavy:react-native-mmkv:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2024-01-09 19:15

Updated : 2024-01-16 20:37

NVD link : CVE-2024-21668

Mitre link : CVE-2024-21668

CVE.ORG link : CVE-2024-21668

JSON object : View

Products Affected

mrousavy

react-native-mmkv

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2024-21668", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "published": "2024-01-09T19:15:12.330", "references": [{"url": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0."}, {"lang": "es", "value": "react-native-mmkv es una librer\u00eda que permite el uso sencillo de MMKV dentro de aplicaciones React Native. Antes de la versi\u00f3n 2.11.0, react-native-mmkv registraba la clave de cifrado opcional para la base de datos MMKV en el registro del sistema Android. Cualquier persona con acceso al Android Debugging Bridge (ADB) puede obtener la clave si est\u00e1 habilitado en la configuraci\u00f3n del tel\u00e9fono. Este error no est\u00e1 presente en dispositivos iOS. Al registrar el secreto de cifrado en los registros del sistema, los atacantes pueden recuperar trivialmente el secreto habilitando ADB y socavando el modelo de subprocesos de una aplicaci\u00f3n. Este problema se solucion\u00f3 en la versi\u00f3n 2.11.0."}], "lastModified": "2024-01-16T20:37:23.550", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mrousavy:react-native-mmkv:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "2F0F4C50-CDEB-4A18-A8BC-E087D59E6D75", "versionEndExcluding": "2.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}