CVE-2021-43849: Denial of Service (DoS) Vulnerability in cordova-plugin-fingerprint-aio
Summary
CVE-2021-43849: cordova-plugin-fingerprint-aio DoS vulnerability. Affects cordova-plugin-fingerprint-aio versions < 5.0.1. Fixed in 5.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cordova-plugin-fingerprint-aio is an npm package that provides fingerprint authentication functionality for Cordova-based mobile applications. It allows developers to integrate biometric authentication features into their apps, enhancing security and user experience. However, a vulnerability has been discovered in versions prior to 5.0.1, which can lead to a denial of service (DoS) condition.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of intents with invalid or empty extras in the de.niklasmerz.cordova.biometric.BiometricActivity component. By sending a specially crafted intent repeatedly, a malicious third-party app or remote attacker can cause the app using this plugin to crash or become unresponsive, resulting in a DoS condition. This can disrupt the normal functioning of the affected app and potentially impact user experience.
How To Fix
Minimum fixed version
5.0.1
This is the first release that contains the fix.
npm install cordova-plugin-fingerprint-aio@5.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 5.0.1 is not immediately feasible, a temporary workaround can be implemented by modifying the 'plugin.xml' file. Change the 'android:exported' attribute of the following code snippet to 'false':
<config-file target="AndroidManifest.xml" parent="application">
<activity android:name="de.niklasmerz.cordova.biometric.BiometricActivity" android:theme="@style/TransparentTheme" android:exported="false"/>
</config-file>
Conclusion
In conclusion, the cordova-plugin-fingerprint-aio npm package prior to version 5.0.1 is vulnerable to a denial of service (DoS) attack. To mitigate this issue, it is crucial to upgrade to the latest version or apply the provided workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for cordova-plugin-fingerprint-aio →
FAQ
cordova-plugin-fingerprint-aio is an npm package that enables developers to integrate fingerprint authentication functionality into Cordova-based mobile applications.
A malicious third-party app or remote attacker can exploit this vulnerability to cause the app using cordova-plugin-fingerprint-aio to crash or become unresponsive, resulting in a denial of service (DoS) condition.
Upgrade to version 5.0.1 of cordova-plugin-fingerprint-aio, which resolves the vulnerability. Alternatively, apply the provided workaround by modifying the 'plugin.xml' file.
No, only versions prior to 5.0.1 are vulnerable. It is recommended to upgrade to the latest version to ensure the security of your application.
For more information, you can refer to the GitHub release page of cordova-plugin-fingerprint-aio and the associated discussion thread.
