[TagAwareCipher] - Decryption Failure (Regex Match)
Impact
Vulnerability in SecureProps involves a regex failing to detect tags during decryption of encrypted data.
This occurs when the encrypted data has been encoded with NullEncoder and passed to TagAwareCipher, and contains special characters such as \n. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format.
The vulnerability affects users who implement TagAwareCipher with any base cipher that has NullEncoder (not default).
Patches
The patch for the issue has been released. Users are advised to update to version 1.2.2.
Workarounds
The main recommendation is to update to the latest version as there are no breaking changes.
If that's not possible, you can use the default Base64Encoder with the base cipher decorated with TagAwareCipher to prevent special characters in the encrypted string from interfering with regex tag detection logic.
This workaround is safe but may involve double encoding since TagAwareCipher uses Base64Encoder by default.
References
Reported issue: https://github.com/IlicMiljan/Secure-Props/issues/20 Pull request resolving bug: https://github.com/IlicMiljan/Secure-Props/pull/21
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | ilicmiljan/secure-props | >= 1.2.0, < 1.2.2 | 1.2.2 |
References
- https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8
- https://nvd.nist.gov/vuln/detail/CVE-2024-28864
- https://github.com/IlicMiljan/Secure-Props/issues/20
- https://github.com/IlicMiljan/Secure-Props/pull/21
- https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627
- https://github.com/IlicMiljan/Secure-Props
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-1333- Platform
- Composer
- Package
ilicmiljan/secure-props- Disclosed
- 18.03.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-rj29-j2g4-77q8 - CC BY 4.0
Vulnerability history: ilicmiljan/secure-props
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.