PT-2024-22613 · Unknown · Secureprops

Ilicmiljan · Published 2024-03-18 · Updated 2025-12-30 · CVE-2024-28864

Positive Technologies (AI Summary)

CVSS v3.1

2.6

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SecureProps versions 1.2.0 through 1.2.1

Description A vulnerability in SecureProps involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with NullEncoder and passed to TagAwareCipher, and contains special characters such as . As a result, the decryption process is skipped since the tags are not detected, causing the encrypted data to be returned in plain format. The vulnerability affects users who implement TagAwareCipher with any base cipher that has NullEncoder (not default).

Recommendations For SecureProps versions 1.2.0 and 1.2.1, update to version 1.2.2 to resolve the issue. As a temporary workaround, consider using the default Base64Encoder with the base cipher decorated with TagAwareCipher to prevent special characters in the encrypted string from interfering with regex tag detection logic.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-28864

GHSA-RJ29-J2G4-77Q8

Affected Products

Secureprops

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28864.json · Exploit
• https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rj29-j2g4-77q8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28864 · Security Note
• https://github.com/IlicMiljan/Secure-Props · Note
• https://github.com/IlicMiljan/Secure-Props/pull/21 · Note
• https://github.com/IlicMiljan/Secure-Props/issues/20 · Note
• https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627 · Note
• https://twitter.com/CVEnew/status/1769849918493962556 · Twitter Post
• https://t.me/cveNotify/147135 · Telegram Post