CVE-2024-45394 Secret encryption vulnerable to brute-force attacks
Attackers with access to encrypted backups can brute-force keys due to weak encryption, exposing user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-45394?
CVE-2024-45394 is a high-severity vulnerability in Authenticator-Extension Authenticator, published on 3 Sep 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVP_BytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the user's encryption key. Users on version 8.0.0 and above are automatically migrated away from the weak encoding on first login. Users should destroy encrypted backups made with versions prior to 8.0.0.
Which versions are affected by CVE-2024-45394?
It affects 1 product.
Products include Authenticator Authenticator.
How do I fix CVE-2024-45394?
No fix has been published for CVE-2024-45394 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-45394 being exploited?
There is no known exploitation of CVE-2024-45394 in the wild and no public exploit code.
Sources
Also known as GHSA-gv8m-vgp8-q2xr.