mrousavy react-native-mmkv up to 2.10.x log file

Summaryinfo

A vulnerability was found in mrousavy react-native-mmkv up to 2.10.x. It has been classified as problematic. This issue affects some unknown processing. The manipulation leads to log file. This vulnerability is traded as CVE-2024-21668. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in mrousavy react-native-mmkv up to 2.10.x (JavaScript Library). It has been rated as problematic. This issue affects an unknown code block. The manipulation with an unknown input leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality. The summary by CVE is:

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.

The weakness was shared 01/09/2024 as GHSA-4jh3-6jhv-2mgp. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2024-21668 since 12/29/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 2.11.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch a8995ccb7184281f7d168bad3e9987c9bd05f00d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• mrousavy

Name

• react-native-mmkv

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10

License

• open-source

Website

• Product: https://github.com/mrousavy/react-native-mmkv/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion