Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-41951

CVE-2024-41951: PheonixAppAPI has visible Encoding Maps

4.4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-41951
GHSA ID
GHSA-258h-f687-4226
EPSS Score
0.11415%
CWE
CWE-323
Published
7/31/2024
Updated
11/12/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
PheonixAppAPIpip< 0.2.50.2.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from exposed encoding/decoding maps in the codebase. The commit diff shows these cryptographic operations are handled in FileManager.py's Encoded functions. The advisory explicitly states the encoding maps were visible in code (CWE-323 context), and these functions directly implement the vulnerable encoding/decoding logic. The high confidence comes from: 1) Advisory directly referencing encoding map exposure 2) CWE-323 alignment with static cryptographic material reuse 3) Functions' responsibility for cryptographic operations 4) Post-install script requirement suggesting key/map generation was moved out of code in the patch.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is is * kin* o* mo**r*t* issu*. T** imp**t is not *i* *or norm*l us*rs *ut **n ** *or us*rs w*o w*nt to s**ur* t**ir *o**/*il*s/*t*. T** issu* is t**t t** m*p o* *n*o*in*/***o*in* l*n*u***s *r* visi*l* in *o**. ### P*t***s T** Pro*l*m

Reasoning

T** vuln*r**ility st*ms *rom *xpos** *n*o*in*/***o*in* m*ps in t** *o****s*. T** *ommit *i** s*ows t**s* *rypto*r*p*i* op*r*tions *r* **n*l** in *il*M*n***r.py's *_*n*o***_* *un*tions. T** **visory *xpli*itly st*t*s t** *n*o*in* m*ps w*r* visi*l* in