Improper Verification of Cryptographic Signature Affecting xml-crypto package, versions >=4.0.0 <6.0.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-XMLCRYPTO-6751737
- published 2 May 2024
- disclosed 2 May 2024
- credit Unknown
Introduced: 2 May 2024
CVE-2024-32962 Open this link in a new tabHow to fix?
Upgrade xml-crypto to version 6.0.0 or higher.
Overview
xml-crypto is a xml digital signature and encryption library for Node.js.
Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the default configuration not checking the authorization of the signer but only the validity of the signature. This oversight allows a malicious actor to re-sign an XML document and insert the certificate in a <KeyInfo /> element. Consequently, any certificate provided via a digitally signed XML document's <KeyInfo /> is trusted by default, even if the library was configured to use a specific certificate (publicCert) for signature verification purposes. An attacker can manipulate the XML document by replacing the existing signature with one generated with a malicious private key and attaching that private key's certificate to the <KeyInfo /> element.
Workaround
This vulnerability in versions 4.x and 5.x can be mitigated by checking the certificate extracted via getCertFromKeyInfo against trusted certificates before accepting the results of the validation or setting xml-crypto's getCertFromKeyInfo to () => undefined, forcing xml-crypto to use an explicitly configured publicCert or privateKey for signature verification.