Executive brief
react-native-mmkv is a high-performance key-value storage library for React Native applications. In versions before 2.11.0 on Android, the library logged database encryption keys to system logs, allowing attackers with Android Debug Bridge (ADB) access to recover the encryption secret and decrypt sensitive app data stored in backups or at rest.
Technical details
The vulnerability is an insertion of sensitive information into log files (CWE-532) in the Android native bridge code. Before version 2.11.0, the MMKV C++ native module logged the optional encryption key parameter directly to Android's system log via __android_log_print(). An attacker with ADB access enabled (a high-privilege requirement on the device) can retrieve all logs and extract the encryption key, completely undermining the database encryption. The vulnerability affects only Android; iOS is not impacted. The fix (commit a8995cc) changes the log message to output only a boolean flag indicating whether encryption is enabled, rather than the key itself. Patched version 2.11.0 was released on 2023-11-10.
Affected products
- margelo react-native-mmkv <2.11.0
Timeline
- 2024-01-09: disclosed
- 2023-11-10: patched: v2.11.0 released with fix