CVE-2024-49364— tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
Quick assessment
Affected
bitcoinjs tiny-secp256k1
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
tiny-secp256k1是bitcoinjs开源的一个包装器。 tiny-secp256k1 1.1.7之前版本存在安全漏洞，该漏洞源于签名恶意JSON可字符串化对象时可能泄露私钥，可能导致私钥提取。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-49364
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
Source: CVE Program / CVE List V5
Vulnerability Description
tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior to version 1.1.7, a private key can be extracted on signing a malicious JSON-stringifiable object, when global Buffer is the buffer package. This affects only environments where require('buffer') is the NPM buffer package. The Buffer.isBuffer check can be bypassed, resulting in k reuse for different messages, leading to private key extraction over a single invalid message (and a second one for which any message/signature could be taken, e.g. previously known valid one). This issue has been patched in version 1.1.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
tiny-secp256k1 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
tiny-secp256k1是bitcoinjs开源的一个包装器。 tiny-secp256k1 1.1.7之前版本存在安全漏洞，该漏洞源于签名恶意JSON可字符串化对象时可能泄露私钥，可能导致私钥提取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| bitcoinjs | tiny-secp256k1 | < 1.1.7 | - |
|
II. Public POCs for CVE-2024-49364
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-49364
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same weakness: CWE-522
-
CVE-2026-104617
sdbootutil: qrencode invocation leaks PIN/recovery key in /p -
CVE-2026-102944
cpp-httplib: Cookie header leaked on cross-origin redirect -
CVE-2026-63160
Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token -
CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure -
CVE-2026-108904
pH7Builder before 18.5.0 Sensitive Data Exposure via Member
V. Comments for CVE-2024-49364
No comments yet