CVE-2023-46234: Signature Forgery Attack in browserify-sign
Summary
CVE-2023-46234: browserify-sign upper bound check issue in dsaVerify leads to a signature forgery attack. Affects browserify-sign versions >= 2.6.0, < 4.2.2. Fixed in 4.2.2. How to fix ↓
Also tracked for
- node-browserify-sign · Debian:11
The same CVE-2023-46234 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
browserify-sign is an npm package that provides a signing and verification API for the browserify project. It is used to sign and verify digital signatures using the DSA algorithm. The package is widely used in projects that involve DSA verification of user-input signatures. However, a vulnerability has been discovered in the package that allows an attacker to construct signatures that can be successfully verified by any public key, leading to a signature forgery attack.
Vulnerability Detail
The vulnerability in browserify-sign arises from an upper bound check issue in the dsaVerify function. The function is responsible for verifying the validity of a DSA signature. However, the checkValue function, which checks whether the signature values r and s are within the legal interval, incorrectly checks the upper bound of the parameters. This allows an attacker to set the value of s to q, which is equivalent to zero, and pass the verification with the signature (r, s) = (1, q). This signature can be successfully verified by any public key, enabling a signature forgery attack. The impact of this vulnerability is significant, as all places in projects that involve DSA verification of user-input signatures using browserify-sign are affected.
How To Fix
Minimum fixed version
4.2.2
This is the first release that contains the fix.
npm install browserify-sign@4.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the browserify-sign package to the fixed version as soon as possible.
Conclusion
The vulnerability in browserify-sign allows an attacker to forge signatures that can be successfully verified by any public key, leading to a signature forgery attack. To mitigate this vulnerability, it is crucial to update the browserify-sign package to version 4.2.2 or later. Developers should also ensure that their applications are regularly scanned for vulnerabilities using tools like Vulert to stay informed about potential security risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for browserify-sign →
FAQ
The vulnerability allows an attacker to forge signatures that can be successfully verified by any public key. This can lead to various security issues depending on the context in which the package is used.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities in real-time.
No, there is no known workaround for this vulnerability. It is recommended to update the browserify-sign package to the fixed version.
There are currently no known exploits for this vulnerability. However, it is important to update the package to the fixed version to prevent any potential attacks.
You can find more information about the fix for this vulnerability in the pull request discussion and diff pages. Unfortunately, the temporary private fork was deleted, but you can access a web archive of the PR discussion and diff pages at the following link: https://github.com/browserify/browserify-sign/files/13172957/PR.webarchive.zip
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
