Executive brief
PheonixAppAPI is a Python library for encoding and decoding operations. The vulnerability exposes the internal encoding/decoding key maps in plaintext within the source code, allowing local users with code access to discover the cryptographic keys used for encoding operations. This could enable attackers to decrypt secured data or forge valid encodings if they gain access to the codebase.
Technical details
The vulnerability (CWE-323) stems from hardcoded, visible encoding and decoding key maps in the PheonixAppAPI source code. An attacker with local code access and low privileges can read these maps directly from the repository or installed package, bypassing the intended key secrecy. The attack requires local file system access but no user interaction. This enables an attacker to obtain the cryptographic keys needed to decrypt previously protected data or forge valid encodings. The issue was patched in version 0.2.5; users must upgrade and run the post_install.py script.
Affected products
- AkshuDev PheonixAppAPI < 0.2.5
Timeline
- 2024-07-31: disclosed