CVE-2021-43849 DoS vulnerability
A third-party app can crash the victim's application by repeatedly calling an exported activity with invalid data, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43849?
CVE-2021-43849 is a medium-severity denial of service vulnerability in NiklasMerz cordova-plugin-fingerprint-aio, published on 23 Dec 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it is requested with invalid or empty data which results in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. Version 5.0.1 of the cordova-plugin-fingerprint-aio doesn't export the activity anymore and is no longer vulnerable. If you want to fix older versions change the attribute android:exported in plugin.xml to false. Please upgrade to version 5.0.1 as soon as possible.
Weakness: CWE-617
Which versions are affected by CVE-2021-43849?
2 open source packages ship an affected version, including cordova-plugin-fingerprint-aio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cordova-plugin-fingerprint-aio npm | All versions | 5.0.1 |
cordova-plugin-fingerprint-aio npm | All versions | 5.0.1 |
Products include Cordova Plugin Fingerprint All-in-One Project Cordova Plugin Fingerprint All-in-One.
How do I fix CVE-2021-43849?
Upgrade cordova-plugin-fingerprint-aio to 5.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-43849 being exploited?
There is no known exploitation of CVE-2021-43849 in the wild and no public exploit code.
Sources
Also known as GHSA-7vfx-hfvm-rhr8.