IlicMiljan Secure-Props 1.2.0/1.2.1 redos

Summaryinfo

A vulnerability, which was classified as problematic, has been found in IlicMiljan Secure-Props 1.2.0/1.2.1. Affected is an unknown function. Performing a manipulation results in redos. This vulnerability was named CVE-2024-28864. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in IlicMiljan Secure-Props 1.2.0/1.2.1. This affects an unknown functionality. The manipulation with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on confidentiality. The summary by CVE is:

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-28864 since 03/11/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

Upgrading to version 1.2.2 eliminates this vulnerability. Applying the patch ab7b561040cd37fda3dbf9a6cab01fefcaa16627 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• IlicMiljan

Name

• Secure-Props

Version

• 1.2.0
• 1.2.1

License

• open-source

Website

• Product: https://github.com/IlicMiljan/Secure-Props/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion