PT-2024-19010 · Unknown · React-Native-Mmkv

Maxammann · Published 2024-01-09 · Updated 2024-01-16 · CVE-2024-21668

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions react-native-mmkv versions prior to 2.11.0

Description The react-native-mmkv library logged the optional encryption key for the MMKV database into the Android system log before version 2.11.0. This allowed anyone with access to the Android Debugging Bridge (ADB) to obtain the key if ADB was enabled in the phone settings. The issue is not present on iOS devices. By logging the encryption secret, attackers could recover the secret and undermine an app's thread model. The encryption of an MMKV database protects data from higher privilege processes on the phone and also encrypts data in potential backups.

Recommendations For versions prior to 2.11.0, update to version 2.11.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the encryption key or restricting access to the Android Debugging Bridge (ADB) until the update is applied.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2024-21668

GHSA-4JH3-6JHV-2MGP

Affected Products

React-Native-Mmkv

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21668.json · Exploit
• https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d · Patch
• https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21668 · Security Note
• https://osv.dev/vulnerability/GHSA-4jh3-6jhv-2mgp · Vendor Advisory
• https://github.com/mrousavy/react-native-mmkv · Note
• https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0 · Note
• https://twitter.com/CVEnew/status/1744809565093523955 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1744834355405398283 · Twitter Post