Reachable Assertion

Summary

The package cordova-plugin-fingerprint-aio is a plugin that provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. The exported activity "de.niklasmerz.cordova.biometric.BiometricActivity" can cause the app to crash. This vulnerability occurred because the activity didn't handle the case where it was requested with invalid or empty data which resulted in a crash. Any third party app can constantly call this activity with no permission. A 3rd party app/attacker using event listener can continually stop the app from working and make the victim unable to open it. In versions 5.0.1 and later of the cordova-plugin-fingerprint-aio, it doesn't export the activity anymore and is no longer vulnerable. Users are advised to upgrade to a fixed version as soon as possible. If you want to fix older versions, change the attribute "android:exported" from "plugin.xml" to false.