CVE-2024-28864: TagAwareCipher Decryption Failure in SecureProps
Summary
CVE-2024-28864: [TagAwareCipher] - Decryption Failure (Regex Match). Affects ilicmiljan/secure-props versions >= 1.2.0, < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SecureProps is a package available on Packagist that provides encryption and decryption functionality for sensitive data. It includes a feature called TagAwareCipher, which allows users to encrypt and decrypt data using different ciphers. The package supports various encoders, including NullEncoder and Base64Encoder. The vulnerability in SecureProps involves a regex failing to detect tags during decryption of encrypted data.
Vulnerability Detail
The vulnerability occurs when encrypted data, encoded with NullEncoder and passed to TagAwareCipher, contains special characters such as '\n'. In this scenario, the regex used for tag detection fails, causing the decryption process to be skipped. As a result, the encrypted data is returned in plain format, potentially exposing sensitive information. This vulnerability affects users who implement TagAwareCipher with any base cipher that has NullEncoder (not the default). The impact of this vulnerability is considered low, with a CVSS score of 2.6.
How To Fix
Minimum fixed version
1.2.2
This is the first release that contains the fix.
composer require ilicmiljan/secure-props:1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not possible, a workaround is to use the default Base64Encoder with the base cipher decorated with TagAwareCipher. This prevents special characters in the encrypted string from interfering with the regex tag detection logic. However, this workaround may involve double encoding since TagAwareCipher uses Base64Encoder by default.
Conclusion
The TagAwareCipher decryption failure vulnerability in SecureProps has been identified and patched in version 1.2.2. Users are advised to update to the latest version to mitigate the risk of exposing sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ilicmiljan/secure-props →
FAQ
The impact of this vulnerability is considered low, with a CVSS score of 2.6. It allows encrypted data to be returned in plain format, potentially exposing sensitive information.
Users who implement TagAwareCipher with a base cipher that has NullEncoder (not the default) are affected by this vulnerability.
The vulnerability can be fixed by updating to version 1.2.2 of SecureProps. Users should modify their composer.json file to require the latest version and run the composer update command.
Yes, a workaround is to use the default Base64Encoder with the base cipher decorated with TagAwareCipher. This prevents special characters in the encrypted string from interfering with the regex tag detection logic.
No, there are no breaking changes in version 1.2.2 of SecureProps. Users can update to this version without any compatibility concerns.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
