Critical Vulnerability in node-forge: Insecure RSA PKCS#1 v1.5 Signature Verification
Summary
CVE-2022-24772: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Affects node-node-forge across 3 version ranges.
< 0.10.0~dfsg-3+deb11u1
< 3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
< bb822c02df0b61211836472e29b9790cc541cdb2
Fixed in 0.10.0~dfsg-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-forge is a native implementation of Transport Layer Security in JavaScript, widely used for secure communications. It provides various cryptographic functionalities, including RSA encryption and signature verification. However, prior to version 1.3.0, it had a significant vulnerability in its RSA PKCS#1 v1.5 signature verification process, which could lead to serious security risks.
Vulnerability Detail
The vulnerability arises from the RSA PKCS#1 v1.5 signature verification code in node-forge, which fails to check for trailing garbage bytes after decoding a DigestInfo ASN.1 structure. This oversight allows attackers to manipulate padding bytes and insert garbage data, potentially forging signatures when a low public exponent is used. The ramifications of this vulnerability can lead to unauthorized access and data integrity issues, making it critical to address.
How To Fix
Minimum fixed version
0.10.0~dfsg-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-node-forgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability. The only effective solution is to upgrade to the fixed version.
Conclusion
The vulnerability in node-forge's RSA PKCS#1 v1.5 signature verification poses a significant security risk. It is crucial for users to upgrade to version 1.3.0 or later to protect against potential exploitation. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for node-node-forge →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions prior to 1.3.0 are affected by this vulnerability.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access and manipulation of data, compromising the integrity of secure communications.
Currently, there are no effective workarounds to mitigate this risk without upgrading to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-node-forge.
