CVE-2024-28864 [TagAwareCipher] - Decryption Failure (Regex Match)
Attackers can retrieve plaintext data from encrypted fields when using TagAwareCipher with NullEncoder due to regex failure, exposing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-28864?
CVE-2024-28864 is a low-severity vulnerability in IlicMiljan Secure-Props, published on 18 Mar 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.
Weakness: CWE-1333
Which versions are affected by CVE-2024-28864?
2 open source packages ship an affected version, including ilicmiljan/secure-props. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ilicmiljan/secure-props Packagist | From 1.2.0 | 1.2.2 |
ilicmiljan/secure-props Packagist | From 1.2.0 | 1.2.2 |
Products include Ilicmiljan Secureprops.
How do I fix CVE-2024-28864?
Upgrade ilicmiljan/secure-props to 1.2.2 or later.
Is CVE-2024-28864 being exploited?
There is no known exploitation of CVE-2024-28864 in the wild and no public exploit code.
Sources
Also known as GHSA-rj29-j2g4-77q8.