Description

The application uses static, hardcoded values for initialization vectors. By knowing initialization vectors an attacker could perform a reverse engineering attack to predict the random values that should remain as secrets.

Impact

Predict random values to craft new attack vectors.

Recommendation

Generate initialization vectors randomly using mechanisms with secure randomness and high entropy.

Threat

Authenticated attacker from the Internet with access to the source code.

Expected Remediation Time

⏱️ 30 minutes.

Requirements

Fixes