CVE-2024-28864: 
PHP vulnerability analysis and mitigation

A vulnerability has been identified in SecureProps versions 1.2.0 and 1.2.1 (CVE-2024-28864). The issue involves a regex failure to detect tags during decryption of encrypted data when the encrypted data has been encoded with NullEncoder and passed to TagAwareCipher, particularly when the data contains special characters such as \n. This vulnerability affects users who implement TagAwareCipher with any base cipher that has NullEncoder (not default) (GitHub Advisory).

The vulnerability stems from a regex-based mechanism that fails to properly match and extract encrypted data encapsulated within tags when special characters are present. When the encrypted data contains special characters like newline (\n), the decryption process is erroneously bypassed as the tags are not detected, resulting in the encrypted data being returned in plain format. The issue has been assigned a CVSS v3.1 base score of 2.6 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N (GitHub Advisory).

When exploited, the vulnerability causes the decryption process to be skipped, resulting in encrypted data being returned in its raw format instead of being properly decrypted. This primarily affects the confidentiality of the data being processed through the SecureProps library when using specific configurations (GitHub Issue).

The vulnerability can be triggered when using TagAwareCipher with a base cipher that utilizes NullEncoder, and the encrypted data contains special characters. The exploitation requires specific conditions and configuration choices, as reflected in the high attack complexity (AC:H) rating in the CVSS score (GitHub Advisory).

The vulnerability has been patched in version 1.2.2 of SecureProps. Users are advised to update to this version. As a workaround, if updating is not immediately possible, users can utilize the default Base64Encoder with the base cipher decorated with TagAwareCipher to prevent special characters in the encrypted string from interfering with regex tag detection logic. While this workaround is safe, it may involve double encoding since TagAwareCipher uses Base64Encoder by default (GitHub Advisory).