Improper Verification of Cryptographic Signature Affecting github.com/evervault/evervault-go package, versions <1.3.2

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via incomplete validation of attestation documents in the attestation verification process. An attacker can cause clients to trust enclaves that do not meet expected integrity guarantees by submitting documents with missing or incomplete PCR values.

Note: This is only exploitable if the application is attesting enclaves hosted outside of the default environment and does not explicitly check for the presence and validity of all required PCRs.

This vulnerability can be mitigated by modifying the application logic to fail verification if PCR8 is not explicitly present and non-empty and/or by adding custom pre-validation to reject documents that omit any required PCRs.

package evervault
import (
        "testing"

        "github.com/evervault/evervault-go/attestation"
        "github.com/stretchr/testify/assert"
        "github.com/hf/nitrite"
)


func TestVulnerableCompare(t *testing.T) {
          assert := assert.New(t)
          // arrange
          expectedPCRs := []attestation.PCRs{
                attestation.PCRs{
                      PCR0:
"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
                      PCR1:
"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002",
                      PCR2:
"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003",
                      PCR8:
"000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004",
                     },
           }
            actualDocument := nitrite.Document {}
            actualDocument.PCRs = map[uint][]byte{
                    10: make([]byte, 32),
            }
            // act
            v := verifyPCRs(expectedPCRs, actualDocument)
            
            // assert
            // Verify should not pass but it does
            
            assert.Equal(true, v)
}

• GitHub Commit
• GitHub PR