cve/2017/CVE-2017-3160.md

### [CVE-2017-3160](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3160)
![](https://img.shields.io/static/v1?label=Product&message=Apache%20Cordova%20Android&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Man-in-the-Middle%20vulnerability&color=brighgreen)

### Description

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build. However, since the default URI is not using https, it is vulnerable to a MiTM and the Gradle executable is not safe. The severity of this issue is high due to the fact that the build scripts immediately start a build after Gradle has been fetched. Developers who are concerned about this issue should install version 6.1.2 or higher of Cordova-Android. If developers are unable to install the latest version, this vulnerability can easily be mitigated by setting the CORDOVA_ANDROID_GRADLE_DISTRIBUTION_URL environment variable to https://services.gradle.org/distributions/gradle-2.14.1-all.zip

### POC

#### Reference
- https://www.oracle.com/security-alerts/cpuapr2020.html

#### Github
No PoCs found on GitHub currently.