Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-50481

CVE-2023-50481: blinksocks has weak encryption algorithms

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-50481
GHSA ID
GHSA-pqj5-37xf-x5gc
EPSS Score
0.24495%
CWE
-
Published
12/21/2023
Updated
12/21/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
blinksocksnpm<= 3.3.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability documentation explicitly identifies two issues in ssr-auth-chain.js: 1) Use of non-random IVs at line 163 (CBC/CFB modes) violating CWE-329, and 2) Use of RC4 algorithm at lines 173/278/391/436 (CWE-327). These functions directly implement cryptographic operations with known insecure patterns. While exact function names aren't provided, the line numbers and context indicate these are core encryption routines handling sensitive data flow.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in *linkso*ks v*rsion *.*.*, *llows r*mot* *tt**k*rs to o*t*in s*nsitiv* in*orm*tion vi* w**k *n*ryption *l*orit*ms in t** *ompon*nt `/pr*s*ts/ssr-*ut*-***in.js`.

Reasoning

T** vuln*r**ility *o*um*nt*tion *xpli*itly i**nti*i*s two issu*s in `ssr-*ut*-***in.js`: *) Us* o* non-r*n*om IVs *t lin* *** (***/*** mo**s) viol*tin* *W*-***, *n* *) Us* o* R** *l*orit*m *t lin*s ***/***/***/*** (*W*-***). T**s* *un*tions *ir**tly