Executive brief
blinksocks is a proxy/tunnel application used for obfuscating network traffic. The library uses outdated and weak encryption algorithms (RC4) and non-random initialization vectors (IVs) in its authentication chain component, potentially allowing attackers to decrypt sensitive information or modify encrypted data in transit.
Technical details
The vulnerability stems from the use of deprecated and cryptographically broken encryption algorithms, specifically RC4, and the reuse of fixed (non-random) initialization vectors in CBC and CFB cipher modes within the SSR authentication chain implementation (lib/presets/ssr-auth-chain.js and lib/presets/ssr-auth-aes128.js). RC4 is known to have serious weaknesses that enable plaintext recovery attacks, and fixed IVs in CBC/CFB modes completely eliminate the security properties of these modes. An attacker with network access to proxied traffic can exploit these weaknesses to recover plaintext or forge ciphertexts. No patch information is available in the advisory at this time.
Affected products
- blinksocks blinksocks up to 3.3.8
Timeline
- 2023-12-04: disclosed: Issue #108 opened on GitHub reporting outdated encryption and fixed IV usage
- 2023-12-21: advisory: GHSA-pqj5-37xf-x5gc and CVE-2023-50481 published