Authentication Bypass in Dropbox Android Application

CVE-2018-12445

What is CVE-2018-12445?

A security flaw in the Dropbox Android application version 98.2.2 allows an attacker to bypass biometric authentication due to improper handling of the FingerprintManager class. The application incorrectly transitions from the onAuthenticationFailed callback to onAuthenticationSucceeded when null values are passed, potentially enabling unauthorized users to authenticate with any fingerprint. While the vendor has noted that this vulnerability is not relevant to their threat model for rooted Android devices, it raises important concerns regarding biometric security implementation in mobile applications.

References