Executive brief
Apache Cordova Android is a framework for building mobile applications. Prior to version 6.0.0, the framework logs sensitive application data using Android's standard logging system, which is accessible to any app on devices running Android 4.0 and earlier. An attacker with another app installed on the device can read these logs to expose sensitive information including user credentials, API keys, and personal data.
Technical details
The vulnerability is an information exposure issue (CWE-532) in cordova-android prior to 6.0.0, where the framework uses Android's Log class (Log.v(), Log.d(), Log.i(), Log.w(), Log.e()) to log messages. These logs are stored in circular buffers (up to four 16 KB rotated logs) accessible via Logcat. On Android versions prior to 4.1 (Jelly Bean), logs are not sandboxed per-application, allowing any installed app to read logs from other applications. The attack requires only local access (another app installed on the device) and no user interaction. The fix involves replacing calls to android.util.Log with Cordova's own logging class (org.apache.cordova.LOG), which respects platform logging restrictions. The vulnerability was patched in version 6.0.0 released in August 2016.
Affected products
- Apache Cordova Android prior to 6.0.0
Timeline
- 2020-09-11: disclosed
- 2016-08-22: patched: Version 6.0.0 released with fix