CVE-2013-5679
OWASP Enterprise Security API for Java 2.x < 2.1.0 - Authenticated-Encryption Bypass via Null MAC
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-5679. PoCs published by dawetmaster, andikahilmy.
AI-analyzed exploit summary This repository contains a vulnerable version of OWASP ESAPI Java (legacy) with examples demonstrating the CVE-2013-5679 vulnerability, which involves insecure handling of encrypted properties. The code includes functional examples for encrypting/decrypting properties, logging, and data persistence, showcasing the flawed implementation.
Description
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
Exploits (2)
This repository contains a vulnerable version of OWASP ESAPI Java (legacy) with examples demonstrating the CVE-2013-5679 vulnerability, which involves insecure handling of encrypted properties. The code includes functional examples for encrypting/decrypting properties, logging, and data persistence, showcasing the flawed implementation.
This repository contains a vulnerable version of OWASP ESAPI Java (legacy) that demonstrates CVE-2013-5679, a cryptographic vulnerability in the EncryptedProperties class. The provided examples and scripts allow users to interact with the flawed encryption mechanisms, showcasing the vulnerability in action.