Cloak
Monthly
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward) lets anyone with write access to the encrypted store silently flip bits in stored ciphertext so that decryption returns an attacker-chosen plaintext of the same length. The affected code paths, Cloak.Ciphers.AES.CTR and Cloak.Ciphers.Deprecated.AES.CTR, encrypt with AES-256 in CTR mode and store the key tag, IV, and ciphertext with no MAC, and decrypt/2 validates only the key tag and a minimum length - so tampered data is returned as valid with no error. Exploitation requires write access to the ciphertext (the description cites SQL injection into the Ecto-backed database or a compromised replica) plus knowledge or a correct guess of the existing plaintext at the tampered offset, and the replacement value must be exactly the same length as the original; impact is integrity-only (VC:N/VA:N), with no public exploit identified at time of analysis. Note the vendor CVSS 4.0 score of 8.2 is driven entirely by VI:H, while an independent assessment applying CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rates the realistic risk considerably lower because an attacker must already control writes to the encrypted store and have plaintext knowledge.
Insufficient password-hashing work factor in the Cloak.Ecto PBKDF2 field module causes hashes to be derived with roughly 18,750 times less computational effort than the configured parameters imply, letting anyone who already holds both the stored hash values and the configured :secret brute-force low-entropy plaintexts (such as email addresses) far more cheaply than the library promises. The affected code is cloak_ecto from 1.0.0-alpha.0 onward and cloak from 0.7.0 before 1.0.0-alpha.0; the vulnerable dump/1 callback passes config[:size] (default 32) into PBKDF2's iteration-count position, so each hash runs 32 rounds instead of the default 600,000. This is a post-compromise amplifier rather than a standalone remote exploit: it requires prior disclosure of the hash column and the application secret, and remains impractical against high-entropy values. No public exploit code was identified at time of analysis, and CISA KEV does not list this CVE; the CNA assigned CVSS 4.0 base 6.3 (medium), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, reflecting the privileged prerequisites and confidentiality-only impact.
Ciphertext tampering in the Cloak Elixir encryption library (danielberkompas/cloak, all versions from 0.1.0-pre onward) lets anyone with write access to the encrypted store silently flip bits in stored ciphertext so that decryption returns an attacker-chosen plaintext of the same length. The affected code paths, Cloak.Ciphers.AES.CTR and Cloak.Ciphers.Deprecated.AES.CTR, encrypt with AES-256 in CTR mode and store the key tag, IV, and ciphertext with no MAC, and decrypt/2 validates only the key tag and a minimum length - so tampered data is returned as valid with no error. Exploitation requires write access to the ciphertext (the description cites SQL injection into the Ecto-backed database or a compromised replica) plus knowledge or a correct guess of the existing plaintext at the tampered offset, and the replacement value must be exactly the same length as the original; impact is integrity-only (VC:N/VA:N), with no public exploit identified at time of analysis. Note the vendor CVSS 4.0 score of 8.2 is driven entirely by VI:H, while an independent assessment applying CVSS 3.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) rates the realistic risk considerably lower because an attacker must already control writes to the encrypted store and have plaintext knowledge.
Insufficient password-hashing work factor in the Cloak.Ecto PBKDF2 field module causes hashes to be derived with roughly 18,750 times less computational effort than the configured parameters imply, letting anyone who already holds both the stored hash values and the configured :secret brute-force low-entropy plaintexts (such as email addresses) far more cheaply than the library promises. The affected code is cloak_ecto from 1.0.0-alpha.0 onward and cloak from 0.7.0 before 1.0.0-alpha.0; the vulnerable dump/1 callback passes config[:size] (default 32) into PBKDF2's iteration-count position, so each hash runs 32 rounds instead of the default 600,000. This is a post-compromise amplifier rather than a standalone remote exploit: it requires prior disclosure of the hash column and the application secret, and remains impractical against high-entropy values. No public exploit code was identified at time of analysis, and CISA KEV does not list this CVE; the CNA assigned CVSS 4.0 base 6.3 (medium), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, reflecting the privileged prerequisites and confidentiality-only impact.