Improper Verification of Cryptographic Signature Affecting node-forge package, versions <1.4.3

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ed25519.verify() in lib/ed25519.js, which does not reject public keys of small order. crypto_sign_open() decodes the public key A with unpackneg(), which only checks that the point is on the curve, and never validates that the key is not a small-order point (the identity point or the other 7 points of order 2, 4, or 8, including non-canonical encodings with y >= p). An attacker who can supply the public key can present a small-order key together with a signature where S = 0 and a small-order R, causing the verification equation R == [k](-A) to hold for many or all messages without knowledge of any private key. For the identity key specifically, the fixed signature R = identity, S = 0 verifies for every message.

Identity public key `A = 01 00 … 00` (32 bytes) and signature `R = 01 00 … 00`, `S = 00 … 00` (64 bytes):

    forge.ed25519.verify({message: 'admin=true', encoding: 'utf8',
      signature: SIG, publicKey: IDENTITY});
    // <= 1.4.2: true for any message; node:crypto.verify(): false
    // 1.4.3: false

Other small-order public keys (orders 2, 4 and 8, and non-canonical encodings) give forgeries for many messages with `S = 0` and a small-order `R`.

Regression tests are in tests/unit/ed25519.js, and the reporter's PoC is in tests/pocs/ghsa-6889-vf6x-f3g5.js.

• GitHub Advisory
• GitHub Commit
• GitHub PR
• GitHub Release