Resources Downloaded over Insecure Protocol

Affecting cordova-android package, versions <6.1.2

Do your applications use this vulnerable package? Test your applications

Overview

cordova-android is an Android application library that allows for Cordova-based projects to be built for the Android Platform.

Affected versions of the package are vulnerable to Man in the Middle (MitM) attacks due to downloading resources over an insecure protocol.

The build scripts would fetch Gradle using HTTP instead of HTTPS

Without a secure connection, it is possible for an attacker to intercept this connection and alter the packages received. In serious cases, this may even lead to Remote Code Execution (RCE) on your host server.

Remediation

Upgrade cordova-android to version 6.1.2 or higher.

References

CVSS Score

6.5
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    Low
  • Availability
    None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Credit
Unknown
CVE
CVE-2017-3160
CWE
CWE-300
Snyk ID
npm:cordova-android:20170127
Disclosed
27 Jan, 2017
Published
12 Feb, 2018