CVE-2021-43849 (published 2021-12-23T17:15Z)

cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-617
cwe_name: Reachable Assertion
description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
extended_description: 
            While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, it can still lead to a denial of service.
            For example, if a server handles multiple simultaneous connections, and an assert() occurs in one single connection that causes all other connections to be dropped, this is a reachable assertion that leads to a denial of service.
         
         

Fix information:
repo_url: https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio
commit_details: repo_url: https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio
author: Hieu Cao
author_date: 2021-12-21 19:43:06+07:00
msg: Update Fingerprint.swift

fix crash issue on device
repository: repo_url: https://github.com/NiklasMerz/cordova-plugin-fingerprint-aio
repo_name: NiklasMerz/cordova-plugin-fingerprint-aio
description: Cordova Plugin for fingerprint sensors (and FaceID) with Android and iOS support
repo_language: Java
owner: NiklasMerz
file_changes: filename: Fingerprint.swift
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,4 @@
+import Cordova
 import Foundation
 import LocalAuthentication
 
@@ -52,6 +53,8 @@ enum PluginError:Int {
                     biometryType = "finger";
                 case .faceID:
                     biometryType = "face"
+                @unknown default:
+                    fatalError()
                 }
             }
 
@@ -143,7 +146,7 @@ enum PluginError:Int {
         do {
             let secret = Secret()
             try? secret.delete()
-            let invalidateOnEnrollment = (data?["invalidateOnEnrollment"] as? Bool) ?? false
+            let invalidateOnEnrollment = (data?.object(forKey: "invalidateOnEnrollment") as? Bool) ?? false
             try secret.save(secretStr, invalidateOnEnrollment: invalidateOnEnrollment)
             pluginResult = CDVPluginResult(status: CDVCommandStatus_OK, messageAs: "Success");
         } catch {
@@ -158,7 +161,7 @@ enum PluginError:Int {
     func loadSecret(_ command: CDVInvokedUrlCommand) {
         let data  = command.arguments[0] as AnyObject?;
         var prompt = "Authentication"
-        if let description = data?["description"] as! String? {
+        if let description = data?.object(forKey: "description") as! String? {
             prompt = description;
         }
         var pluginResult: CDVPluginResult
@@ -186,7 +189,7 @@ enum PluginError:Int {
     @objc(registerBiometricSecret:)
     func registerBiometricSecret(_ command: CDVInvokedUrlCommand){
         let data  = command.arguments[0] as AnyObject?;
-        if let secret = data?["secret"] as? String {
+        if let secret = data?.object(forKey: "secret") as? String {
             self.saveSecret(secret, command: command)
             return
         }

programming_language: Swift