Executive brief
cordova-plugin-china-picker is a Cordova plugin library for image selection used in mobile applications. Version 1.0.910 contained malicious code that harvests sensitive payment card data (card numbers, CVCs, and password fields) from web forms and exfiltrates them to an external server, posing a critical risk to customer financial data and application security.
Technical details
Version 1.0.910 of cordova-plugin-china-picker contains embedded malicious code (CWE-506) that executes in the browser context of any application using this library. The malicious payload searches for and exfiltrates sensitive form field data—specifically password fields, card numbers (cardnumber), and CVCs—by sending them to https://js-metrics.com/minjs.php?pl=. The attack requires no authentication and no user interaction beyond normal use of an application that includes the compromised library version. Any developer using version 1.0.910 in production has exposed all form data entered by end users to credential and payment card theft. No patches are available; remediation requires removing version 1.0.910 and using an alternate version before or after this release.
Affected products
- Apache Cordova cordova-plugin-china-picker 1.0.910
Timeline
- 2020-09-01: disclosed