Use of a Broken or Risky Cryptographic Algorithm Affecting tech.kwik:kwik package, versions [,0.8)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-TECHKWIK-7116681
- published 26 May 2024
- disclosed 24 May 2024
- credit Unknown
Introduced: 24 May 2024
CVE-2024-22588 Open this link in a new tabHow to fix?
Upgrade tech.kwik:kwik to version 0.8 or higher.
Overview
Affected versions of this package are vulnerable to Use of a Broken or Risky Cryptographic Algorithm due to the discard process. An attacker can exploit this vulnerability by leveraging unused encryption keys.
PoC
Attackers must be able to sniff the network traffic.
Capture the first QUIC packets sent by a QUIC client.
Compute the Initial encryption key as described in https://www.rfc-editor.org/rfc/rfc9001.html#name-keys
Send a
CONNECTION_CLOSEframe to the server in an initial packet encrypted using the computed initial encryption key.Because the server does not discard the Initial keys, it will decrypt and process the Initial packet sent in (4) even after the QUIC handshake is completed.