CVE-2024-41951

Encoding/decoding language map exposed in Phoenix App's code.

• CVSS 4.4
• CWE-323
• Information Leakage
• Local

Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the map of encoding/decoding languages are visible in code. The Problem was patched in 0.2.4.

CVE

CVE-2024-41951

CWE

CWE-323

CVSS base score

4.4

Published

2024-07-31

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Function

Code defect classification

Extraneous Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Local

Impact

Information Disclosure

Affected component

Pheonix App

Solution

Upgrade to version 0.2.4 or later.

encoding_map = {
    'text1': 'encoded_text1',
    'text2': 'encoded_text2'
}

def encode_data(data):
    return {key: encoding_map.get(key, key) for key in data}

data_to_encode = ['text1', 'text2']
encoded_data = encode_data(data_to_encode)
print(encoded_data)

import json

def load_encoding_map():
    with open('encoding_map.json', 'r') as file:
        return json.load(file)

encoding_map = load_encoding_map()

def encode_data(data):
    return {key: encoding_map.get(key, key) for key in data}

data_to_encode = ['text1', 'text2']
encoded_data = encode_data(data_to_encode)
print(encoded_data)

# Example payload that could be used to exploit the vulnerability
malicious_input = ['text1', 'text2', 'malicious_command']
encoded_data = encode_data(malicious_input)
print(encoded_data)

@misc{vaitp:cve202441951,
  title        = {{Encoding/decoding language map exposed in Phoenix App's code.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-41951},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-41951/}}
}