search

mobilpay / Node.js

Proof of concept - mobilPay integration in Node.js
8 stars 4 forks source link

RSA_PKCS1_PADDING is no longer supported for private decryption #7

Closed EfrosIonelu closed 5 months ago

EfrosIonelu commented 6 months ago

TypeError: RSA_PKCS1_PADDING is no longer supported for private decryption, this can be reverted with --security-revert=CVE-2023-46809 at Object.privateDecrypt (node:internal/crypto/cipher:80:12)

EfrosIonelu commented 6 months ago

https://nodejs.org/en/blog/vulnerability/february-2024-security-releases

lco91 commented 5 months ago

pana rezolva cei de la Netopia, daca o sa rezolve, se poate folosi node-forge:

const decrypt2 = (privateKeyPem, env_key, encryptedData) => {
    const privateKey = forge.pki.privateKeyFromPem(privateKeyPem);
    const decodedEnvKey = forge.util.decode64(env_key);
    const symmetricKey = Buffer.from(privateKey.decrypt(decodedEnvKey, 'RSAES-PKCS1-V1_5'), 'binary');
    const decodedData = forge.util.decode64(encryptedData);
    const binaryData = Buffer.from(decodedData, 'binary');
    const cipher = rc4(symmetricKey);
    return cipher.decode(binaryData, 'utf8');
};

mai trebuie: npm install node-forge si const forge = require('node-forge');

eFlavian commented 4 months ago

pana rezolva cei de la Netopia, daca o sa rezolve, se poate folosi node-forge:

const decrypt2 = (privateKeyPem, env_key, encryptedData) => {
    const privateKey = forge.pki.privateKeyFromPem(privateKeyPem);
    const decodedEnvKey = forge.util.decode64(env_key);
    const symmetricKey = Buffer.from(privateKey.decrypt(decodedEnvKey, 'RSAES-PKCS1-V1_5'), 'binary');
    const decodedData = forge.util.decode64(encryptedData);
    const binaryData = Buffer.from(decodedData, 'binary');
    const cipher = rc4(symmetricKey);
    return cipher.decode(binaryData, 'utf8');
};

mai trebuie: npm install node-forge si const forge = require('node-forge');

Thumbs up 👍🏼 Just a quick fix :)

const cipher = rc4('arc4', symmetricKey);