CVE-2020-11990: 
NixOS vulnerability analysis and mitigation

CVE-2020-11990 is a security vulnerability affecting the camera plugin in certain Cordova (Android) applications. The issue was discovered and disclosed in September 2020, affecting Apache Cordova Plugin camera versions prior to 5.0.0. The vulnerability allows an attacker who can install or convince a victim to install a specially crafted Android application to access pictures taken with the affected Cordova app externally (NVD, JVN Advisory).

The vulnerability occurs because vulnerable versions of Apache Cordova Plugin camera, when used in Android applications, utilize the external storage on the device as an image file cache when available. Any applications with READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE permissions can access these cached files, leading to information exposure (CWE-200). The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (JVN Advisory).

When a user is tricked into installing a malicious application on an Android device with external storage, and the user takes a photo with the vulnerable application, the image file is cached on the external storage. The malicious application can then retrieve the file contents from the external storage, potentially exposing sensitive user photos (JVN Advisory).

The vulnerability requires local access and user interaction. An attacker must first convince a user to install a malicious application on their device. The malicious application must also have the appropriate storage permissions to access the external storage where the cached images are stored (JVN Advisory).

The vulnerability was fixed in Apache Cordova Plugin camera version 5.0.0. The fix involved changing the location of temporarily saved images from external to internal cache storage. Android Cordova applications using the camera plugin should be updated to version 5.0.0 or higher. While the fix was implemented in version 4.2.0's source code, this version was not officially released, making 5.0.0 the first version with the security fix (Cordova Blog, JVN Advisory).