Bixilon Minosoft CryptManager CryptManager.kt missing encryption

Summaryinfo

A vulnerability has been found in Bixilon Minosoft and classified as problematic. Affected by this issue is some unknown functionality of the file CryptManager.kt of the component CryptManager. Performing a manipulation results in missing encryption. This vulnerability is known as CVE-2024-56141. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Bixilon Minosoft (the affected version unknown). It has been classified as problematic. This affects an unknown part of the file CryptManager.kt of the component CryptManager. The manipulation with an unknown input leads to a missing encryption vulnerability. CWE is classifying the issue as CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. This is going to have an impact on confidentiality. The summary by CVE is:

Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager  encryption routine ( CryptManager.kt ) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-56141 since 12/16/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-55650). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Bixilon

Name

• Minosoft

Website

• Product: https://github.com/Bixilon/Minosoft/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion