Apache cordova-plugin-inappbrowser CVE-2019-0219 Privilege Escalation Vulnerability

Description

Apache cordova-plugin-inappbrowser is prone to a privilege-escalation vulnerability. Remote attackers can exploit this issue to gain elevated privileges or execute arbitrary code in the context of the affected application. Versions prior to Apache cordova-plugin-inappbrowser 3.1.0 are vulnerable.

Technologies Affected

• Apache Cordova
• Apache cordova-plugin-inappbrowser 1.5.0
• Apache cordova-plugin-inappbrowser 1.9.0
• Apache cordova-plugin-inappbrowser 2.0.0
• Apache cordova-plugin-inappbrowser 2.9.0
• Apache cordova-plugin-inappbrowser 3.0.0

Recommendations

Block external access at the network boundary, unless external parties require service.
Filter access to the affected computer at the network boundary if global access isn’t needed. Restricting access to only trusted computers and networks might greatly reduce the likelihood of a successful exploit.

Run all software as a nonprivileged user with minimal access rights.
To reduce the impact of latent vulnerabilities, always run nonadministrative software as an unprivileged user with minimal access rights.

Implement multiple redundant layers of security.
Since this issue may be leveraged to execute code, we recommend memory-protection schemes, such as non-executable stack/heap configurations and randomly mapped memory segments. This tactic may complicate exploits of memory-corruption vulnerabilities.

Updates are available. Please see the references or vendor advisory for more information.