CVE-2024-28864: Ilicmiljan/secure props [TagAwareCipher] - Decryption Failure (Regex Vulnerability

LOW
Advisory Identifier: GHSA-rj29-j2g4-77q8
Share
CVSS 2.6
CWE-1333
Published
Advisory Summary

CVE-2024-28864 is a LOW (CVSS 2.6) [tagawarecipher] - decryption failure (regex vulnerability (CWE-1333: Inefficient Regular Expression Complexity) affecting Ilicmiljan/secure props libraries in the Packagist ecosystem. The issue involves [tagawarecipher] - decryption failure (regex match). Remediation is available by upgrading affected packages to version 1.2.2.

CVE-2024-28864 at a Glance

CVE Identifier CVE-2024-28864
GHSA Identifier GHSA-rj29-j2g4-77q8
Severity LOW
CVSS v3.1 Base Score 2.6
CWE Classification CWE-1333: Inefficient Regular Expression Complexity
Affected Product Ilicmiljan/secure props
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 2.6

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2024-28864

To remediate this vulnerability, upgrade all affected Ilicmiljan/secure props dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

ilicmiljan/secure-props fixed: 1.2.2 
Upgrade ilicmiljan/secure-props to 1.2.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for ilicmiljan/secure-props

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-28864, inspect your project dependencies for Ilicmiljan/secure props:

inspect dependencies for ilicmiljan/secure-props

Analyze the terminal output to locate any version of Ilicmiljan/secure props in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.2.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1333: Inefficient Regular Expression Complexity, where the product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. In Ilicmiljan/secure props, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact Vulnerability in **SecureProps** involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). ### Patches The patch for the issue has been released. Users are advised to update to version **1.2.2**. ### Workarounds **The main recommendation is to update to the latest version as there are no breaking changes.** If that's not possible, you can use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `Base64Encoder` by default. ### References Reported issue: https://github.com/IlicMiljan/Secure-Props/issues/20 Pull request resolving bug: https://github.com/IlicMiljan/Secure-Props/pull/21

CVE-2024-28864 Affected Ilicmiljan/secure props Versions

1 component(s)
Fixed Versions:
1.2.2
Product / Package Ecosystem Affected Versions Fixed Version
ilicmiljan/secure-props
 Packagist
≥ 1.2.0
< 1.2.2
1.2.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8
NVD — CVE-2024-28864 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28864
Ilicmiljan/secure props Source Repository REPOSITORY
https://github.com/IlicMiljan/Secure-Props/issues/20
Ilicmiljan/secure props Source Repository REPOSITORY
https://github.com/IlicMiljan/Secure-Props/pull/21
Security Fix Commit FIX COMMIT
https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627
Ilicmiljan/secure props Source Repository REPOSITORY
https://github.com/IlicMiljan/Secure-Props

Frequently Asked Questions

What is CVE-2024-28864?
CVE-2024-28864 is a security vulnerability in Ilicmiljan/secure props involving [TagAwareCipher] - Decryption Failure (Regex Match) under CWE-1333: Inefficient Regular Expression Complexity.
Which Ilicmiljan/secure props versions are affected?
Affected versions include releases prior to 1.2.2 across affected packages: ilicmiljan/secure-props.
What version fixes CVE-2024-28864?
Upgrading to 1.2.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is ilicmiljan/secure-props affected?
Yes, ilicmiljan/secure-props is affected in releases prior to 1.2.2. Upgrade your dependency to 1.2.2 or later.
What is the CVSS score of CVE-2024-28864?
CVE-2024-28864 has a CVSS v3.1 base score of 2.6 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2024-28864?
CVE-2024-28864 is classified under CWE-1333: Inefficient Regular Expression Complexity (The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.).
How can I check Packagist dependencies for CVE-2024-28864?
Run the dependency tree command: 'inspect dependencies for ilicmiljan/secure-props'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rj29-j2g4-77q8",
  "modified" : "2024-03-19T18:30:48Z",
  "published" : "2024-03-18T20:39:00Z",
  "aliases" : [ "CVE-2024-28864" ],
  "summary" : "[TagAwareCipher] - Decryption Failure (Regex Match)",
  "details" : "### Impact\n\nVulnerability in **SecureProps** involves a regex failing to detect tags during decryption of encrypted data. \n\nThis occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. \n\nThe vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default).\n\n### Patches\n\nThe patch for the issue has been released. Users are advised to update to version **1.2.2**.\n\n### Workarounds\n\n**The main recommendation is to update to the latest version as there are no breaking changes.**\n\nIf that's not possible, you can use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. \n\nThis workaround is safe but may involve double encoding since `TagAwareCipher` uses `Base64Encoder` by default.\n \n### References\n\nReported issue: https://github.com/IlicMiljan/Secure-Props/issues/20\nPull request resolving bug: https://github.com/IlicMiljan/Secure-Props/pull/21\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "ilicmiljan/secure-props"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "1.2.0"
      }, {
        "fixed" : "1.2.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-28864"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/IlicMiljan/Secure-Props/issues/20"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/IlicMiljan/Secure-Props/pull/21"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/IlicMiljan/Secure-Props"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1333" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-03-18T20:39:00Z",
    "nvd_published_at" : "2024-03-18T22:15:09Z"
  }
}