itinance / itinance/react-native-fs

Hash Generated Using Broken Cryptography API (SHA1)

Open
#1,238 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
5k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

### Hash Generated Using Broken Cryptography API (SHA1)
**Severity:** Medium
**Exploitability:** Difficult
**CVSS:** 4.0

The following code locations within the App use 'CC_SHA1' or 'CryptoKit.Insecure.SHA1' functions to generate a message digest:
`-[RNFSManager hash:algorithm:resolver:rejecter:] calls _CC_SHA1()`

The vulnerable code locations use the 'CC_SHA1' or 'CryptoKit.Insecure.SHA1' hashing functions, which leverage hashing algorithms that are proven to be vulnerable to [collision attacks](https://shattered.it/), and are unsuitable for modern use.

Apple officially considers this algorithm insecure. They state in [iOS 13 CryptoKit documentation](https://developer.apple.com/documentation/cryptokit/insecure/sha1):

> This hash algorithm isn't considered cryptographically secure, but is provided for backward compatibility with older services that require it. For new services, prefer one of the secure hashes, like SHA512.

**Recommendation:**
Switch each usage of these outdated hashing functions to use a stronger algorithm with better collision resistance properties, such as SHA-256 or SHA-512.

**Stack Trace:**
The following related source code symbols were identified:
```
- [RNFSManager read:length:position:resolver:rejecter:]
- [RNFSManager __rct_export__3009]
- [RNFSManager readFile:resolver:rejecter:]
@"EISDIR: illegal operation on a directory, read"
@"ENOENT: no such file or directory, open '%@'"
@"Invalid hash algorithm '%@'"
```

**Analysis:**
On tracking, found the vulnerable codes inside [RNFSManager.m](https://github.com/itinance/react-native-fs/blob/master/RNFSManager.m) file.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.