nzo/url-encryptor-bundle Insecure default secret key and IV allowing anyone to decrypt values
The advisory, in context
Versions of nzo/url-encryptor-bundle prior to 5.0.1 and 4.3.2 are affected by a security vulnerability related to the lack of mandatory key and IV requirements. By default, the bundle uses the aes-256-ctr algorithm, which is susceptible to malleability attacks, potentially leading to Insecure Direct Object Reference (IDOR) vulnerabilities. Additionally, the reuse of keys enables users to decrypt and modify encrypted data if they can guess the plaintext of one ciphertext.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 5.0.0 before 5.0.1
Fixed in 5.0.1
1 explicitly affected versions
v5.0.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v5.0.0"
]
}From 4.0.0 before 4.3.2
Fixed in 4.3.2
7 explicitly affected versions
4.1.0, 4.2.0, 4.2.1, v4.2.2, v4.2.3, v4.3.0, v4.3.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.1.0",
"4.2.0",
"4.2.1",
"v4.2.2",
"v4.2.3",
"v4.3.0",
"v4.3.1"
]
}References
- https://github.com/nayzo/NzoUrlEncryptorBundle/commit/ba3af1a9bcf3bedcc0ed5948979f482e2134da1a
- https://github.com/nayzo/NzoUrlEncryptorBundle/commit/bd8232501c12c9df1bc45b1970870ef665218581
- https://github.com/FriendsOfPHP/security-advisories/blob/master/nzo/url-encryptor-bundle/2020-05-03.yaml
- https://github.com/nayzo/NzoUrlEncryptorBundle