CVE-2019-9196

Vulnerability

The Face authentication component in Aware mobile liveness SDK 2.2.0 (used in Knomi) allows bypass of biometric liveness authentication. The vulnerability lies in the /knomi/analyze endpoint where the security_level field can be tampered with, leading to insufficient validation [1]. Affected versions: sdk 2.2.0 for Knomi, described in liveness 2.2.1 [1].

Exploitation

An attacker can remotely exploit this vulnerability without authentication [1]. By sending a crafted request with a modified security_level parameter to the /knomi/analyze endpoint, the liveness check can be bypassed. Attack complexity is low [1].

Impact

Successful exploitation results in bypass of biometric liveness authentication, allowing an attacker to spoof the liveness check [1]. Integrity impact is partial, as the attacker can impersonate a legitimate user's liveness verification, but confidentiality and availability are not affected [1].

Mitigation

As of the publication date (2019-05-15), no fix is mentioned in the available reference [1]. Users should contact Aware for updated SDK versions. The vulnerability is listed on cxsecurity [1].