Insecure RSA PKCS#1 v1.5 Signature Verification in node-forge
Summary
CVE-2022-24773: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Affects node-node-forge across 3 version ranges.
< 0.10.0~dfsg-3+deb11u1
< 3f0b49a0573ef1bb7af7f5673c0cfebf00424df1
< bb822c02df0b61211836472e29b9790cc541cdb2
Fixed in 0.10.0~dfsg-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-forge is a native JavaScript implementation of Transport Layer Security (TLS) and various cryptographic functions. It is widely used for secure communications and data encryption in web applications. The library provides functionalities such as certificate generation, encryption, and decryption. However, prior to version 1.3.0, it contained a critical vulnerability in its RSA PKCS#1 v1.5 signature verification process, which could allow attackers to exploit improperly structured signatures.
Vulnerability Detail
The vulnerability arises from the RSA PKCS#1 v1.5 signature verification code in node-forge, which fails to adequately check the ASN.1 structure of the DigestInfo. This oversight can lead to successful verification of signatures that, while having a valid digest, contain invalid structures. The implications of this vulnerability are significant, as it could allow an attacker to forge signatures and potentially bypass security measures, leading to unauthorized access or data manipulation.
How To Fix
Minimum fixed version
0.10.0~dfsg-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-node-forgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability other than upgrading to the fixed version.
Conclusion
The vulnerability in node-forge's RSA PKCS#1 v1.5 signature verification poses a significant risk, allowing for potential signature forgery. Users are strongly advised to upgrade to version 1.3.0 or later to ensure the security of their applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for node-node-forge →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for vulnerabilities.
If exploited, this vulnerability could allow attackers to forge signatures, leading to unauthorized access or manipulation of sensitive data.
Yes, upgrading to node-forge version 1.3.0 or later will resolve this vulnerability.
While there are no workarounds, it is crucial to prioritize upgrading to the fixed version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-node-forge.
