Description
The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can leverage these vulnerabilities to decrypt sensitive obfuscated strings, including ConnectionString values containing database credentials from appsettings.json.
Problem types
CWE-321: Use of Hard-coded Cryptographic Key
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Product status
Any version
Credits
Ianis BERNARD from NATO Cyber Security Centre (NCSC)
References
linqi.help/en/reference/security/security-advisories/