Executive brief
A React Native library used to handle SMS verification and user consent on Android devices contains a flaw in how it exports a system component. An attacker with local access to the device can redirect SMS messages or intercept consent flows intended for the application, potentially allowing unauthorized access to accounts that rely on SMS-based verification.
Technical details
The vulnerability is a CWE-926 (Improper Export of Android Application Components) in the SmsUserConsentModule.kt file, specifically in the registerReceiver function. The BroadcastReceiver was not properly protected with the required SEND_PERMISSION permission, allowing other applications or local attackers to interact with it. An attacker with local access (user-level privilege on the device) can redirect or intercept SMS intents intended for the vulnerable application. The issue was patched in version 1.1.5 by adding the SEND_PERMISSION to the dynamically registered BroadcastReceiver, preventing unauthorized applications from sending intents to it.
Affected products
- kyivstarteam react-native-sms-user-consent up to 1.1.4
Timeline
- 2024-04-07: disclosed: Advisory published (CVE-2021-4438 disclosed to public in 2024 for vulnerability discovered earlier)
- 2021-04-23: patched: Fix merged in PR #4 as commit 5423dcb0cd3e4d573b5520a71fa08aa279e4c3c7, released in version 1.1.5