PT-2020-19719 · Facebook · React-Native-Fast-Image

Andrei Alecu · Published 2020-07-17 · Updated 2021-05-18 · CVE-2020-7696

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions react-native-fast-image versions prior to 8.3.0

Description The issue arises when an image is loaded with a source that includes headers, such as host and authorization. This causes all subsequent images to use the same headers, potentially leading to the leakage of signing credentials or other session tokens to other servers. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 8.3.0, update to version 8.3.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the authorization header in the source object of images until the issue is resolved. Restrict access to sensitive information, such as signing credentials, to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-7696

GHSA-6XHG-Q9C8-RJ32

SNYK-JS-REACTNATIVEFASTIMAGE-572228

Affected Products

React-Native-Fast-Image

References · 7

• 🔥 https://github.com/DylanVann/react-native-fast-image/issues/690 · Exploit
• 🔥 https://github.com/DylanVann/react-native-fast-image/pull/691 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228 · Exploit
• https://osv.dev/vulnerability/GHSA-6xhg-q9c8-rj32 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7696 · Security Note
• https://github.com/DylanVann/react-native-fast-image/commit/4a7cd64f5b0aa40b04d63ccb105ee2b511abe624 · Note