Internal NCryptDecrypt method could be used externally from WindowsHello library.
Moderate severity
GitHub Reviewed
Published
Apr 14, 2020
in
SeppPenner/WindowsHello
•
Updated Jan 9, 2023
Package
Affected versions
< 1.0.4
Patched versions
1.0.4
Description
Reviewed
Apr 14, 2020
Published to the GitHub Advisory Database
Apr 14, 2020
Last updated
Jan 9, 2023
Impact
Every user of the library before version 1.0.4.
Patches
Patched in 1.0.4+.
Workarounds
None.
References
SeppPenner/WindowsHello#3
For more information
It this library is used to encrypt text and write the output to a txt file, another executable could be able to decrypt the text using the static method NCryptDecrypt from this same library without the need to use Windows Hello Authentication again.
References