Improper Certificate Validation Affecting node-forge package, versions <1.4.3

node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Affected versions of this package are vulnerable to Improper Certificate Validation via pki.verifyCertificateChain() in lib/x509.js, which does not decode or enforce the X.509 nameConstraints extension (OID 2.5.29.30) during certificate path validation. A certificate authority whose nameConstraints extension is marked non-critical can issue a leaf certificate with a subjectAltName dNSName or subject commonName outside its permitted subtrees or inside its excluded subtrees, and the chain passes verification. This allows an attacker holding such a CA's private key, or able to obtain a certificate issued under it, to impersonate arbitrary names - including in TLS peer verification via forge.tls - defeating the namespace restriction the constraint was intended to enforce.

Note: This is only exploitable when a name-constrained CA with a non-critical nameConstraints extension chains to a root trusted by the application, and the attacker controls that CA's private key or can obtain an out-of-scope certificate from it. Chains without nameConstraints are unaffected, and chains with a critical nameConstraints extension were already rejected.

Pass an options.verify callback to pki.verifyCertificateChain() (or verify to forge.tls.createConnection()) that returns an error when any CA certificate in the chain has an extension with id 2.5.29.30. This rejects all chains below a name-constrained CA, including valid ones. Trust anchors with the extension must be checked separately.

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub PR
• GitHub Release