Critical Vulnerability in node-node-forge: Lenient RSA PKCS#1 v1.5 Signature Verification
Summary
DEBIAN-CVE-2022-24771: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Affects node-node-forge versions < 0.10.0~dfsg-3+deb11u1. Fixed in 0.10.0~dfsg-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-node-forge is a native implementation of Transport Layer Security (TLS) in JavaScript, providing developers with tools to create secure applications. It supports various cryptographic operations, including encryption, decryption, and digital signatures. However, prior to version 1.3.0, the package had a significant vulnerability in its RSA PKCS#1 v1.5 signature verification code, which could lead to security breaches.
Vulnerability Detail
The vulnerability arises from lenient checks in the RSA PKCS#1 v1.5 signature verification process, allowing an attacker to craft a malicious structure that can steal padding bytes. This flaw can be exploited when a low public exponent is used, enabling the attacker to forge a signature by manipulating the unchecked portions of the PKCS#1 encoded message. The implications of this vulnerability are severe, as it compromises the integrity of digital signatures, potentially allowing unauthorized actions to be taken in the context of secure communications.
How To Fix
Minimum fixed version
0.10.0~dfsg-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-node-forgeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to update to the fixed version as soon as possible.
Conclusion
The vulnerability in node-node-forge poses a significant risk due to its impact on RSA PKCS#1 v1.5 signature verification. It is crucial for developers to update to the patched version to safeguard their applications against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-node-forge →
FAQ
The vulnerability involves lenient checks in the RSA PKCS#1 v1.5 signature verification, allowing attackers to forge signatures.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions being taken, as it compromises the integrity of digital signatures.
Yes, the vulnerability has been addressed in node-node-forge version 1.3.0. It is recommended to update to this version or later.
Update the node-node-forge package to the fixed version using the command: 'sudo apt-get install node-node-forge=0.10.0~dfsg-3+deb11u1'.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-node-forge.
