Blog RSS Feed

CVE announcements for Cordova-Android
20 Nov 2015

Updated 02/20/2016

Apache Cordova has re-visited CVE-2015-5256 "Apache Cordova vulnerable to improper application of whitelist restrictions on Android”. Upon further investigation we found that the vulnerability is more limited than was previously understood. We are lowering the severity to Low, and updating the description, affected versions, and upgrade path.

CVE-2015-5257 continues to be a valid vulnerability present in Cordova 3.6.4 and this is fixed in later versions of Cordova, and we want to encourage users to upgrade to 4.1.1 and for users needing to support Marshmallow (API 23+) we recommend to upgrade to Cordova Android 5.1.x.

When using the Cordova CLI, the command to use 4.1.1 or 5.1.0 of Cordova Android is:

cordova platform add android@4.1.0
cordova platform add android@5.1.0

The security issues are CVE-2015-5256 and CVE-2015-5257

For your convenience, the text of the CVEs are included here.


Updated 02/20/2016

CVE-2015-5256: Apache Cordova vulnerable to improper application of whitelist restrictions on Android

Severity: Low

Versions Affected: Cordova Android with whitelist functionality

Description:

Android applications created using Apache Cordova that use a remote server contain a vulnerability where whitelist restrictions for urls using protocols http and https are not properly applied. Whitelist cannot block network redirects from a whitelisted remote website to a non-whitelisted website.

Upgrade path:

There is no specific software patch for this vulnerability. Developers that are concerned about this should make sure to only whitelist trusted websites, and make sure that whitelisted websites don’t redirect to a malicious website. Developers should also use SSL, as well as Content Security Policy(CSP) to further mitigate this issue. It’s always recommended for developers to upgrade to the latest version of Cordova Android.

Credit: Muneaki Nishimura of Sony Digital Network Applications, Inc __

CVE-2015-5257: Weak Randomization of BridgeSecret for Apache Cordova Android

Severity: Low

Vendor: The Apache Software Foundation

Versions Affected: Cordova Android versions up to 3.6.4

Description:

Cordova uses a bridge that allows the Native Application to communicate with the HTML and Javascript that control the user interface. To protect this bridge on Android, the framework uses a BridgeSecret to protect it from third-party hijacking. However, the BridgeSecret is not sufficiently random and can be determined in certain scenarios.

Upgreade Path:

Developers who are concerned about this issue should rebuild their applications with Cordova Android 4.1.1 or later. Versions after 3.6.4 do not contain this vulnerability.

Credit: David Kaplan & Roee Hay, IBM X-Force Application Security Research Team

Previous

Apache Cordova Windows 4.2.0
11 Nov 2015 - By Sergey Grebnov

We are happy to announce that Cordova Windows 4.2.0 has been released!...

Next

Plugins Release
24 Nov 2015 - By Steve Gill

The following plugins were updated today: cordova-plugin-battery-status@1.1.1 cordova-plugin-camera@2.0.0 cordova-plugin-console@1.0.2 cordova-plugin-contacts@2.0.0 cordova-plugin-device@1.1.0 cordova-plugin-device-motion@1.2.0...