Security vulnerability due to using com.nimbusds:nimbus-jose-jwt:5.1 #2533
Description
Steps to Reproduce
We have got a security warning flagged by NowSecure, our mobile security scanner. The test looks in the decompiled code of the binary for instances of static strings being used as cryptographic seeds. It advised us that code in our app is using a hardcoded byte array as a seed value for encryption. It traced this hardcoded byte array to com.nimbusds:nimbus-jose-jwt:5.1, (see stack trace below) which we traced to this library
react-native-code-push/android/app/build.gradle
Line 30 in b9fb9fb
implementation 'com.nimbusds:nimbus-jose-jwt:5.1'
Expected Behavior
When initializing encryption, do not use a hardcoded byte array as a seed value. Instead, consider using dynamic values such as SecureRandom in order to create a secure initialization of the cryptography. The Findings Evidence table provides the instances where a hardcoded value was used.
see Android Developer Guidance and Code Samples for Secure Cryptography https://developer.android.com/guide/topics/security/cryptography
A suggested fix might be to use a different library or encourage nimbus to change how they are seeding encryption.
Actual Behavior
The application is using static values as seeds for encryption. This means that any attacker who sees those static seeds will be able to easily decrypt that data. If the data being encrypted is sensitive information, the attacker will be able to see and exploit the information.
STACK TRACE AND/OR SCREENSHOTS
{
"location": "Lcom/nimbusds/jose/crypto/AESGCMKW;,decryptCEK,(Ljavax/crypto/SecretKey;[BLcom/nimbusds/jose/crypto/AuthenticatedCipherText;ILjava/security/Provider;)Ljavax/crypto/SecretKey;",
"hardcoded_value": "Lcom/nimbusds/jose/crypto/AESGCM;,decrypt,(Ljavax/crypto/SecretKey;[B[B[B[BLjava/security/Provider;)[B",
"instance_type": "Ljavax/crypto/spec/SecretKeySpec;"
}
Environment
react-native-code-push version: 7.0.3
react-native version: 0.64.2
iOS/Android/Windows version: android 29
Does this reproduce on a debug build or release build?: release
Does this reproduce on a simulator, or only on a physical device?: both
(The more info the faster we will be able to address it!)