CVE-2024-28864

SecureProps is a PHP library designed to simplify the encryption and decryption of property data in objects. A vulnerability in SecureProps version 1.2.0 and 1.2.1 involves a regex failing to detect tags during decryption of encrypted data. This occurs when the encrypted data has been encoded with `NullEncoder` and passed to `TagAwareCipher`, and contains special characters such as `\n`. As a result, the decryption process is skipped since the tags are not detected. This causes the encrypted data to be returned in plain format. The vulnerability affects users who implement `TagAwareCipher` with any base cipher that has `NullEncoder` (not default). The patch for the issue has been released. Users are advised to update to version 1.2.2. As a workaround, one may use the default `Base64Encoder` with the base cipher decorated with `TagAwareCipher` to prevent special characters in the encrypted string from interfering with regex tag detection logic. This workaround is safe but may involve double encoding since `TagAwareCipher` uses `NullEncoder` by default.

• CWE-1333

• https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627Technical Description
• https://github.com/IlicMiljan/Secure-Props/issues/20Issue Tracking, Mitigation
• https://github.com/IlicMiljan/Secure-Props/pull/21Issue Tracking
• https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8Vendor Advisory
• https://github.com/IlicMiljan/Secure-Props/commit/ab7b561040cd37fda3dbf9a6cab01fefcaa16627Technical Description
• https://github.com/IlicMiljan/Secure-Props/issues/20Issue Tracking, Mitigation
• https://github.com/IlicMiljan/Secure-Props/pull/21Issue Tracking
• https://github.com/IlicMiljan/Secure-Props/security/advisories/GHSA-rj29-j2g4-77q8Vendor Advisory

Published

Mar 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28859Symfony1 is a community fork of symfony 1.4 with DIC, form e…9
• CVE-2024-2886Use after free in WebCodecs in Google Chrome prior to 123.0.…7.5
• CVE-2024-28860Cilium is a networking, observability, and security solution…6.8
• CVE-2024-28861Symfony 1 is a community-driven fork of the 1.x branch of Sy…9.8
• CVE-2024-28862The Ruby One Time Password library (ROTP) is an open source …5.5
• CVE-2024-28863node-tar is a Tar for Node.js. node-tar prior to version 6.2…6.5
• CVE-2024-28865django-wiki is a wiki system for Django. Installations of dj…7.5
• CVE-2024-28866GoCD is a continuous delivery server. GoCD versions from 19.…6.1
• CVE-2024-28867Swift Prometheus is a Swift client for the Prometheus monito…7.4
• CVE-2024-28868Umbraco is an ASP.NET content management system. Umbraco 10 …5.3
• CVE-2024-28869Traefik is an HTTP reverse proxy and load balancer. In affec…7.5
• CVE-2024-2887Type Confusion in WebAssembly in Google Chrome prior to 123.…7.7