CVE-2017-11133
HighSummary
An issue exists in heinekingmedia StashCat regarding the generation of encryption keys for messages. The use of AES in CBC mode with a pseudo-random secret generated by math.random() does not provide adequate security.
Risk Assessment
Organizations may be vulnerable to message decryption by third parties, leading to a loss of data confidentiality. The weakness in the encryption algorithm could result in serious information security consequences.
Recommendation
It is recommended to update to the latest version of StashCat that improves the key generation method. Additionally, consider implementing further security measures for transmitted data.
Other vulnerabilities in heinekingmedia StashCat
See all- CVE-2017-11132High
An issue was discovered in heinekingmedia StashCat before version 1.5.18 for Android related to the lack of certificate pinning. As a result, an attacker could issue a certificate for the backend, and the application would not notice it.
- CVE-2017-11130High
An issue was discovered in heinekingmedia StashCat related to the lack of integrity and authenticity checks in the protocol. Affected versions are 1.7.5 for Android, 0.0.80w for Web, and 0.0.86 for Desktop.
- CVE-2017-11129Critical
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android related to key storage. The keystore is locked with a hard-coded password, allowing anyone with access to read its contents, including the user's private key.
Original NVD description (English source)
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with CryptoJS.lib.WordArray.random() in newer versions, which uses math.random() internally. This is not cryptographically strong.