PT-2024-20960 · Unknown · React Native Document Picker

Published 2024-02-16 · Updated 2024-08-19 · CVE-2024-25466

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions React Native Document Picker versions prior to 9.1.1 React Native Document Picker version 8.2.2 and earlier

Description A Directory Traversal issue allows a local attacker to execute arbitrary code via a crafted script to the Android library component. This issue can be exploited by a local attacker.

Recommendations For React Native Document Picker versions prior to 9.1.1, update to version 9.1.1 to resolve the issue. For React Native Document Picker version 8.2.2 and earlier, update to version 9.1.1 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-26

Related Identifiers

CVE-2024-25466

GHSA-PMGM-H3CC-M4HJ

Affected Products

React Native Document Picker

References · 13

• 🔥 https://github.com/FixedOctocat/CVE-2024-25466/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-25466 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25466 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pmgm-h3cc-m4hj · Vendor Advisory
• https://github.com/rnmods/react-native-document-picker/blob/0be5a70c3b456e35c2454aaf4dc8c2d40eb2ab47/android/src/main/java/com/reactnativedocumentpicker/RNDocumentPickerModule.java · Note
• https://github.com/rnmods/react-native-document-picker/commit/ad0b5e58252eba56a5a3b22311a66ffa5e65cffe · Note
• https://github.com/rnmods/react-native-document-picker · Note
• https://github.com/rnmods/react-native-document-picker/commit/1ae7cb217d23a551bff86ad10c7ae6f5e074490f · Note
• https://github.com/rnmods/react-native-document-picker/releases/tag/v8.2.2 · Note
• https://github.com/rnmods/react-native-document-picker/pull/698 · Note
• https://t.me/cvenotify/71701 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1758455521533694122 · Twitter Post
• https://twitter.com/CVEnew/status/1758419638201798919 · Twitter Post