Is CVE-2023-46233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-46233 being exploited in the wild.

How severe is CVE-2023-46233?

Low severity, with a CVSS score of 3.1, published 25 October 2023.

Which products and versions are affected?

crypto-js (npm) SEMVER:introduced=0,fixed=4.2.0.

Is there a fix for CVE-2023-46233?

Yes. crypto-js (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-46233 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-46233?

Check whether you run crypto-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-46233: crypto-js PBKDF2 weak key derivation with insufficient iterations

CVE-2023-46233 · Severity: low · CVSS 3.1 · Published 2023-10-25

crypto-js is a JavaScript library for cryptographic operations used by thousands of applications to derive encryption keys from passwords. The PBKDF2 key-derivation function in crypto-js defaults to only 1 iteration and SHA1 hashing, making it 1,000 times weaker than 1993 standards and 1.3 million times weaker than current industry recommendations. Attackers can forge cryptographic signatures or compromise password-protected data with relatively modest computational resources.

Technologies: crypto-js (npm). Vendors: npm.

Quick answers

Is CVE-2023-46233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-46233 being exploited in the wild.
How severe is CVE-2023-46233?: Low severity, with a CVSS score of 3.1, published 25 October 2023.
Which products and versions are affected?: crypto-js (npm) SEMVER:introduced=0,fixed=4.2.0.
Is there a fix for CVE-2023-46233?: Yes. crypto-js (npm): upgrade to 4.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-46233 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-46233?: Check whether you run crypto-js (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

crypto-js (npm): upgrade to 4.2.0 or later
```
npm install crypto-js@4.2.0
```

Technical details

The vulnerability exists in the crypto-js PBKDF2 implementation, which defaults to a single iteration count and SHA1 as the hash algorithm, rather than the OWASP-recommended 1,300,000 iterations with SHA256. PBKDF2 is a key-derivation function used to stretch password entropy and protect password storage; its security relies critically on a high iteration count to slow down brute-force attacks. The weak defaults make offline password cracking and signature forgery attacks computationally feasible: an attacker can generate colliding signatures for known inputs for approximately $45,000 in compute costs, and due to length-extension weaknesses, can forge signatures for unknown data prefixed by known values even when salts or peppers are applied. The vulnerability affects all versions of crypto-js since its creation; the package is unmaintained and no official patch is available, though version 4.2.0 or later may contain fixes via community contributions.

Affected products

crypto-js crypto-js all versions before 4.2.0

Identifiers

CVE-2023-46233
GHSA-xwcq-pm8m-c4vf

Timeline

2023-10-25: disclosed
2023-10-25: advisory

References

https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.