PT-2024-35742 · Unknown · Cookie-Encrypter

Mathys Reboux · Published 2024-12-09 · Updated 2024-12-12 · CVE-2024-53441

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions cookie-encrypter version 1.0.1

Description The issue is related to a weakness in the encryption method used, allowing attackers to execute a bit flipping attack, specifically an AES CBC bit flipping attack, by exploiting the decryptCookie function in index.js. This enables attackers to edit encrypted cookies without decrypting them, using the publicly visible initialization vector (IV).

Recommendations For cookie-encrypter version 1.0.1, consider disabling the decryptCookie function in index.js as a temporary workaround until a patch is available. Restrict access to the decryptCookie function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-325

CWE-327

Related Identifiers

CVE-2024-53441

GHSA-H63V-HW6G-X8HP

Affected Products

Cookie-Encrypter

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-53441 · Security Note
• https://osv.dev/vulnerability/GHSA-h63v-hw6g-x8hp · Vendor Advisory
• https://github.com/ebourmalo/cookie-encrypter · Note
• https://github.com/ebourmalo/cookie-encrypter/issues/9 · Note
• https://gist.github.com/mathysEthical/f45f1503f87381090e38a33c50eec971 · Note
• https://t.me/cvenotify/103635 · Telegram Post
• https://mathys.reboux.pro/CVE/2024/53441 · Note
• https://t.me/cvenotify/103963 · Telegram Post
• https://twitter.com/CVEnew/status/1866432983265099919 · Twitter Post
• https://crypto.stackexchange.com/questions/66085/bit-flipping-attack-on-cbc-mode · Note
• https://twitter.com/VulmonFeeds/status/1866220699020313028 · Twitter Post
• https://t.me/cvedetector/12446 · Telegram Post