Vulnerability-Lookup

GHSA-4JH3-6JHV-2MGP

Vulnerability from github – Published: 2024-01-09 19:33 – Updated: 2024-01-09 21:52

Summary

react-native-mmkv Insertion of Sensitive Information into Log File vulnerability

Details

Summary

Before version v2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices.

Details

The bridge for communicating between JS code and native code on Android logs the encryption key. This was fixed in commit a8995cc by only logging whether encryption is used.

Impact

The encryption of an MMKV database protects data from higher privilege processes on the phone that can access the app storage. Additionally, if data in the app's storage is encrypted, it is also encrypted in potential backups. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model.

The bug was discovered and fixed by somebody else. Not me. I'm just reporting this so users of react-native-mmkv upgrade the dependency.

Severity ?

4.4 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "react-native-mmkv"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-21668"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-09T19:33:09Z",
    "nvd_published_at": "2024-01-09T19:15:12Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\nBefore version [v2.11.0](https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0), the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices.\n\n## Details\nThe bridge for communicating between JS code and native code on Android logs the encryption key. This was fixed in commit [a8995cc](https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d) by only logging whether encryption is used.\n\n## Impact\nThe encryption of an MMKV database protects data from higher privilege processes on the phone that can access the app storage. Additionally, if data in the app\u0027s storage is encrypted, it is also encrypted in potential backups.\nBy logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app\u0027s thread model.\n\nThe bug was discovered and fixed by somebody else. Not me. I\u0027m just reporting this so users of react-native-mmkv upgrade the dependency.",
  "id": "GHSA-4jh3-6jhv-2mgp",
  "modified": "2024-01-09T21:52:47Z",
  "published": "2024-01-09T19:33:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21668"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mrousavy/react-native-mmkv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "react-native-mmkv Insertion of Sensitive Information into Log File vulnerability"
}

CVE-2024-21668 (GCVE-0-2024-21668)

Vulnerability from cvelistv5 – Published: 2024-01-09 19:05 – Updated: 2025-06-17 14:26

Title

Insertion of Sensitive Information into Log File in react-native-mmkv

Summary

react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app's thread model. This issue has been patched in version 2.11.0.

Severity ?

4.4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

GitHub_M

References

URL

Tags

	https://github.com/mrousavy/react-native-mmkv/sec…	x_refsource_CONFIRM
	https://github.com/mrousavy/react-native-mmkv/com…	x_refsource_MISC
	https://github.com/mrousavy/react-native-mmkv/rel…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	mrousavy	react-native-mmkv	Affected: < 2.11.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:27:35.869Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp"
          },
          {
            "name": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d"
          },
          {
            "name": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-21668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-07T16:44:20.437998Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T14:26:17.894Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "react-native-mmkv",
          "vendor": "mrousavy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone with access to the Android Debugging Bridge (ADB) if it is enabled in the phone settings. This bug is not present on iOS devices. By logging the encryption secret to the system logs, attackers can trivially recover the secret by enabling ADB and undermining an app\u0027s thread model. This issue has been patched in version 2.11.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-09T19:05:49.332Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mrousavy/react-native-mmkv/security/advisories/GHSA-4jh3-6jhv-2mgp"
        },
        {
          "name": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mrousavy/react-native-mmkv/commit/a8995ccb7184281f7d168bad3e9987c9bd05f00d"
        },
        {
          "name": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mrousavy/react-native-mmkv/releases/tag/v2.11.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4jh3-6jhv-2mgp",
        "discovery": "UNKNOWN"
      },
      "title": "Insertion of Sensitive Information into Log File in react-native-mmkv"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-21668",
    "datePublished": "2024-01-09T19:05:49.332Z",
    "dateReserved": "2023-12-29T16:10:20.368Z",
    "dateUpdated": "2025-06-17T14:26:17.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-4JH3-6JHV-2MGP

Summary

Details

Impact

CVE-2024-21668 (GCVE-0-2024-21668)

Tags

Sightings

Nomenclature