CyberRota Analysis
AI-GeneratedThe Phalcon PHP framework prior to version 5.14.1 is vulnerable due to a flaw in the HMAC tag comparison mechanism within the Crypt::decrypt function, which allows attackers to exploit timing discrepancies to recover valid tag bytes. This could enable an attacker to manipulate encrypted content, leading to unauthorized decryption of tampered data. Organizations using affected versions of Phalcon should prioritize upgrading to version 5.14.1 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.