PT-2024-40444 · Nzo · Nzo/Url-Encryptor-Bundle

Published 2024-05-17 · Updated 2024-05-17

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions nzo/url-encryptor-bundle versions prior to 5.0.1 nzo/url-encryptor-bundle versions prior to 4.3.2

Description The issue is related to the lack of mandatory key and IV requirements in the affected versions. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. The reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.

Recommendations For versions prior to 5.0.1, update to version 5.0.1 or later to resolve the issue. For versions prior to 4.3.2, update to version 4.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the use of the aes-256-ctr algorithm until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

Related Identifiers

GHSA-R2R8-36PQ-27CM

Affected Products

Nzo/Url-Encryptor-Bundle

References · 5

• https://osv.dev/vulnerability/GHSA-r2r8-36pq-27cm · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/nzo/url-encryptor-bundle/2020-05-03.yaml · Note
• https://github.com/nayzo/NzoUrlEncryptorBundle/commit/ba3af1a9bcf3bedcc0ed5948979f482e2134da1a · Note
• https://github.com/nayzo/NzoUrlEncryptorBundle/commit/bd8232501c12c9df1bc45b1970870ef665218581 · Note
• https://github.com/nayzo/NzoUrlEncryptorBundle · Note