Use Of Vulnerable Cryptographic Library

Use of Vulnerable Cryptographic Library

Overview of the Vulnerability

Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. The application uses a vulnerable cryptographic library which can allow an attacker to decrypt sensitive information.

Business Impact

This vulnerability can lead to reputational damage of the company through the impact to customers’ trust, and the ability of an attacker to view data. The severity of the impact to the business is dependent on the sensitivity of the accessible data being transmitted by the application.

Steps to Reproduce

1. Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP

2. Setup {{software}} to intercept and log requests

3. Use a browser to navigate to: {{URL}}

4. {{action}} to view unencrypted requests

Proof of Concept (PoC)

The following screenshot(s) demonstrate(s) this vulnerability:

{{screenshot}}

Recommendation(s)

Implement strong cryptography and keep up to date algorithms, protocols, and keys in place. Use only trustworthy cryptographic algorithms outlined within security standards and regulations.

For more information, refer to the following resources:

• https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html

• https://owasp.org/Top10/A02_2021-Cryptographic_Failures/

Guidance

Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards. Please include specific details on where you identified the vulnerable cryptographic library, how you identified it, and what actions you were able to perform as a result.

Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC).