GitHub Advisoryadvisory · npm

GHSA-h63v-hw6g-x8hp Bit flip attack vulnerability in cookie-encrypter

HIGH Published 2024-12-09 Modified 2024-12-11 Official page ↗
Aliases
CVE-2024-53441
Ecosystem
npm
Packages
cookie-encrypter
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses
CWE-325, CWE-327
Reviewed
2024-12-11

Affected packages

• npm cookie-encrypter: <= 1.0.1 (no fix yet)

Description

due to a weakness in the encryption method used in cookie-encrypter an attack can use the world visible IV to edit encrypted cookies without decrypting the cookie itself. This is known as an AES CBC bit flipping attack.

Related

Alias · CVE (1)

  • CVE-2024-53441 An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack. vulnerability

Weakness · CWE (2)

  • CWE-325 Missing Cryptographic Step weakness
  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References